Authentication

Authenticate every request.
Scoped API keys.

Integrations authenticate with a scoped, rotatable API key issued in the portal. The web portal itself signs in through OpenID Connect; you do not need OAuth to call the API.

API keys

Keys are created in the portal (Account, then API Keys) by an account owner and shown once. Each key is granted a level per module - Read, Write or Delete, each including the ones below it - up to the platform maximum, and each endpoint in the API Reference lists the module and level it needs; a key without it gets 403 API_PERMISSION_DENIED. A key looks like on8_3f9a12bc_Ab3xK...: send it on every request in the Authorization header with the ApiKey scheme.

request.sh
curl --request POST \
  --url 'https://api.on8.ai/api/v1/screening/sanctions' \
  --header 'Authorization: ApiKey on8_3f9a12bc_Ab3xK...' \
  --header 'Content-Type: application/json' \
  --data '{ "query": "Vladimir Petrov", "schemaType": "Person", "mode": "fuzzy" }'

Scopes, IP allowlists and rotation

Pin a key to an allowlist (or blocklist) of exact IPs or CIDR ranges; requests from elsewhere get 403 IP_NOT_ALLOWED, with the message Request IP is not in the key's allowlist. (or, for a blocklist, Request IP is blocked for this key.). The message does not echo the IP. Rotate a key from the portal at any time: the old value stops working immediately and the new one is shown once. Revoked or expired keys answer 401 INVALID_API_KEY, and endpoints that are portal-only answer 403 SCOPE_NOT_GRANTED to any key.

403 Forbidden
{
  "success": false,
  "error": {
    "code": "IP_NOT_ALLOWED",
    "message": "Request IP is not in the key's allowlist."
  }
}

Scope every key

A key is granted a level per module (Read, Write or Delete; each includes the ones below it), up to the platform maximum, and its permissions cannot be edited after creation. Grant each integration only the modules and levels its endpoints list in the API Reference, use a separate key per integration and rotate regularly - one key can then be revoked without disrupting the others. Revoked keys stop working immediately.

Always over HTTPS

All requests must use TLS. Pin keys to an IP allowlist for an extra layer of protection.

Ready to make your first call?

Generate a key in the portal, then explore every endpoint in the API reference.

Open API Reference