Authentication

All endpoints under /v1/* require authentication. Health endpoints (/health, /health/ready) are public.

API Key

Include your API key in every request using the x-api-key header:

Code
 
x-api-key: YOUR_API_KEY

Your API key is provisioned by your account manager and is tied to your partner account. All queries are automatically scoped to your tenant — you will only see data belonging to your customer account.

HMAC Signature Verification

When enabled, requests must also include HMAC signature headers. This is handled automatically by the Zuplo API gateway. If you are accessing the API through the gateway, no additional action is needed.

Unauthorized Responses

If your API key is missing, invalid, or inactive, you will receive:

Code
 
{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "No valid authentication provided",
    "request_id": "550e8400-e29b-41d4-a716-446655440000"
  }
}