Skip to main content
Every request belongs to one tenant: the tenant of the key or person making it. There are two kinds of caller.

​
API keys

For CRMs, scripts and other systems. A key looks like pk_live_<prefix>_<secret>. Send it in either header:
  • Create with POST /v1/api-keys (keys:manage). The key is returned once; only its prefix and a hash of the secret are kept, so a lost key cannot be recovered, only replaced.
  • Scopes default to jobs:write jobs:read underwriting:write. A key can never hold a permission its creator lacks. A key can also be given an expiry.
  • Rotate with POST /v1/api-keys/{id}/rotate?overlap_seconds=3600: a new key with the same name and scopes, the old one valid for the overlap so your systems can switch without downtime.
  • Revoke with DELETE /v1/api-keys/{id}. Revoked and expired keys are refused with 401.

​
People

People sign in through AuthKit, and their access token is the bearer. The token’s organization names the tenant, and its role (or explicit permissions) sets what they may do:

​
Permissions

A missing permission is 403. GET /v1/me shows the caller, its tenant, its permissions and the tenant’s modules. Every change (keys, settings, webhooks, mailboxes, erasures) is written to the audit log, read with GET /v1/audit-log.

​
Errors

Every error has the same shape, and the request id is also in the X-Request-ID header. Quote it when you contact support.

​
Rate limits

  • Writes (POST, PATCH, DELETE): 120 a minute per API key or person, and 600 a minute per tenant.
  • Reads: about 1,200 a minute per caller.
  • Jobs: at most max_active_jobs (20 by default) queued or running per tenant at once.
Beyond a limit the answer is 429 with Retry-After.