Access and reference
Inspect the key you are using, look up reference data, and manage users,
roles, service accounts, and API keys. Paths are relative to
/api/v1.
Current key
GET/me
Scope: none. Any valid key may call this endpoint.
Return the key that made the request: key_id, key_name,
organization_id, scopes, expires_at,
and service_account_id (or null for user-owned keys).
Reference data
GET/redaction-types
Scope: templates:read
List the valid redaction types and layers. Use these values when you create redactions.
GET/exemptions
Scope: templates:read
List the exemption codes that can be applied to redactions.
GET/templates
Scope: templates:read
List the redaction templates available to your organization.
GET/templates/{template_id}
Scope: templates:read
Read one redaction template.
Users
Lists in this section are not paginated. They return every item in
data and a cursor of null.
GET/users
Scope: users:read
List the members of your organization.
POST/users
Scope: users:write · Idempotency-Key required
Create a user and add them to your organization.
| Field | Type | Required | Description |
|---|---|---|---|
email | string | Yes | Email address of the new user. |
first_name | string | No | Given name. |
last_name | string | No | Family name. |
GET/users/{user_id}
Scope: users:read
Read one user.
PATCH/users/{user_id}
Scope: users:write · Idempotency-Key required
Update a user's first_name or last_name.
DELETE/users/{user_id}
Scope: users:write
Deactivate a user. Keys owned by the user stop working. Returns 204 No Content.
POST/users/{user_id}/invite
Scope: users:write · Idempotency-Key required
Send an invitation to a user. Body: email (string).
PUT/users/{user_id}/roles
Scope: roles:write · Idempotency-Key required
Replace the roles assigned to a user. Body: role_ids (array of
role IDs). The new list replaces the previous one; it does not add to it.
Roles
GET/roles
Scope: roles:read
List the roles in your organization.
POST/roles
Scope: roles:write · Idempotency-Key required
Create a role. Body: name (required), description,
and permissions (an array of scopes). A role cannot grant
scopes that the calling key does not hold.
GET/roles/{role_id}
Scope: roles:read
Read one role.
PATCH/roles/{role_id}
Scope: roles:write · Idempotency-Key required
Update a role's name, description, or permissions.
DELETE/roles/{role_id}
Scope: roles:write
Delete a role. Returns 204 No Content.
Service accounts and API keys
Service accounts own API keys for system integrations. Creating or
changing service accounts and issuing, rotating, or revoking keys
requires the credentials:write scope; reading them requires
credentials:read.
GET/service-accounts
Scope: credentials:read
List service accounts in your organization.
POST/service-accounts
Scope: credentials:write · Idempotency-Key required
Create a service account. Body: name (required) and
max_scopes (the highest scopes its keys may ever hold).
Scopes must come from the catalogue in the scopes table.
GET/service-accounts/{service_account_id}
Scope: credentials:read
Read one service account.
PATCH/service-accounts/{service_account_id}
Scope: credentials:write · Idempotency-Key required
Update a service account's name or max_scopes.
DELETE/service-accounts/{service_account_id}
Scope: credentials:write
Delete a service account. Returns 204 No Content.
GET/service-accounts/{service_account_id}/api-keys
Scope: credentials:read
List the keys issued for a service account. Full key values are never returned by this endpoint.
POST/service-accounts/{service_account_id}/api-keys
Scope: credentials:write · Idempotency-Key required
Issue a new API key. Body: name (required), expires_in
(days, default 30), and scopes (must be a subset of
the service account's max_scopes).
The response includes the full key. Copy it when it is returned;
it cannot be shown again. Returns 201 Created.
POST/api-keys/{api_key_id}/rotate
Scope: credentials:write · Idempotency-Key required
Issue a replacement for an existing key. Body: overlap_seconds
(optional, default 300). The old key keeps working for the overlap
period so you can switch over without downtime. The new key is returned once.
DELETE/api-keys/{api_key_id}
Scope: credentials:write
Revoke a key immediately. Returns 204 No Content.