External API v1

The v1 external API lets integrations manage cases, upload and process documents, review redactions, generate exports, and receive webhook notifications. Every endpoint is authenticated with an API key and limited by the scopes granted to that key.

Base URL

All v1 endpoints are served under /api/v1 on the RedactStripes API host for your environment. Requests and responses use JSON; send Content-Type: application/json with any request body.

Authentication

Send your API key in the x-api-key header on every request:

curl https://{api-host}/api/v1/me \
  -H "x-api-key: rdx_live_..."

• Keys start with rdx_live_ and are 40 to 128 characters long.
• The full key is shown only once, when it is created or rotated. Store it in a secret manager.
• A key stops working when it is revoked, when it expires, or when the account or service account that owns it is deactivated.
• Call GET /api/v1/me to see the key's scopes, organization, and expiry.

Scopes

Each endpoint lists the scope it requires. A key may call an endpoint only when it holds at least one of the scopes listed for that endpoint. Scopes are granted when a key is created and cannot exceed the max_scopes of its service account.

Requests and responses

Success envelope

Single resources are returned as data. Every response includes a request_id that you can quote when reporting a problem.

{
  "data": { "id": "case_123", "name": "Records request 2026-014" },
  "request_id": "req_01J..."
}

List envelope and pagination

Collections return data as an array and a cursor for the next page. The cursor is null when there are no more results. Use limit (default 25, maximum 100) and pass the returned cursor back as the cursor query parameter.

{
  "data": [ { "id": "case_123" } ],
  "cursor": "eyJpZCI6...",
  "request_id": "req_01J..."
}

Error envelope

{
  "error": {
    "code": "permission_denied",
    "message": "This API key does not have the required scope(s): cases:write"
  },
  "request_id": "req_01J..."
}

Idempotency

Every POST, PUT, and PATCH request must include an Idempotency-Key header. Use a unique value (a UUID is a good choice) for each logical operation and reuse it when retrying the same request.

• If a request with the same key and the same body was already processed, the stored response is returned with Idempotency-Replayed: true.
• If the same key is sent with a different body, the request fails with 409 idempotency_key_reused.
• Keys are kept for 24 hours and are scoped to the API key, the route, and the method.

Rate limits

Related