Developer API
Create and monitor a secure API integration
Use Enterprise API keys from trusted server-side systems and investigate requests safely.
7 minute read Developers and workspace adminsUpdated 15 August 2026
On this page
Quick answer
Create a named, narrowly scoped, expiring key for each server-side integration, store the full secret once, make a test request and use request IDs and safe error categories to investigate failures.
Access and key security
- Developer API access is available to eligible Enterprise workspaces.
- Choose read-only unless the integration genuinely needs to add text sources or queue outputs.
- New keys expire after 90 days by default and each workspace can have up to 10 active keys.
- The full secret is displayed once and stored by the platform as a one-way hash.
- Never place the key in browser code, a mobile application, a public repository, logs or a support request.
Make the first request
- Create a key named for the environment or integration.
- Store it as CONTRACTINGCLAIMS_API_KEY in the server's secret manager.
- Call GET /v1/public/projects with the x-api-key header.
- Confirm the response and request ID, then verify the request in the API dashboard.
Errors and limits
- 401: the key is missing, invalid, expired, revoked or inactive.
- 402: the workspace plan does not include API access.
- 403: the key does not have the required scope.
- 429: the per-key request limit has been reached.
- Quote the request ID to support, but never send the API key or confidential request body.
Still need help?
Continue with the assistant or support team
The in-app assistant can explain the page you are using. For an account-specific problem, send support the expected result, reproduction steps and any safe request or job ID.