Authentication & scopes
Every /v1 call needs an API key. Scopes on that key decide which routes it can use.
Header
X-API-Key: abr_live_…
X-API-Version: 1
X-API-Version: 1 is optional. /v1 already selects the version; an unsupported value returns 400.
Create keys in Settings → API Keys. See Create an API key. Test and live use the same host; only the prefix changes (abr_test_… vs abr_live_…).
Scopes
Scopes are chosen when the key is created. They cannot be edited later — revoke and create a new key.
For the published project workflow you typically need both:
| Scope | Allows |
|---|---|
verify:submit |
POST /v1/projects, POST /v1/projects/{id}/resumptions, POST /v1/projects/{id}/review/resumptions |
verify:read |
GET /v1/projects, GET /v1/projects/{id}, and the deliverable list and single-deliverable routes |
These need a valid key but no specific scope:
GET /v1/meGET /v1/languagesGET /v1/credits/balance
The create-key dialog may list other scopes (audit:read, audit:export, cortex:read). They are not required for the published /v1 project flow.
Check the key
curl -s https://api-arbitr.straker.ai/v1/me \
-H "X-API-Key: abr_live_…"
200 returns org_id, mode (live or test), and scopes.
Failures
| Status | When |
|---|---|
401 |
Missing, unknown, or revoked key (invalid_api_key) |
403 |
Valid key, missing scope (insufficient_scope) |
Example 403:
{
"error": {
"code": "insufficient_scope",
"message": "This API key is missing the required scope 'verify:submit'.",
"required_scope": "verify:submit",
"request_id": "…"
}
}
Keep request_id if you contact support.