Skip to main content
An API key is a single credential that grants access to everything in your organization. There is no per-user or per-resource restriction: any endpoint reachable with the key operates across the whole organization. Treat a key as a privileged secret.
If your integration is used by more than one person, or a call should never reach data its user cannot see, use OAuth Apps instead.

​
Base URL

​
Authentication

Include your API key in every request using the X-API-Key header:

​
API Key Format

API keys follow the format ca_<base64url_encoded_string>. Example: ca_xYz123AbCdEfGhIjKlMnOpQrStUvWxYz

​
Obtaining a key

Generate an API key from the Chamelio web application. The full key value is shown once, at creation - store it in your secret manager before closing the dialog.

​
Verifying a key

A 200 response confirms the key is valid and shows which organization it belongs to.

​
Authentication Errors

The API returns 401 Unauthorized with one of the following messages: It returns 403 Forbidden when the key is valid but the user who created it is no longer an active member of the organization:
A key rejected this way is revoked, not merely refused. Deactivating a user permanently invalidates every API key they created, and reactivating them does not bring the keys back - create new ones. Before offboarding someone, check which integrations depend on keys they own.

​
Rate Limiting

Requests are rate limited per API key, using a one-minute window. Every authenticated response carries the current state: Once the limit is exceeded the API returns 429 Too Many Requests with a Retry-After header holding the number of seconds until the window resets:
Your key’s limit is reported as rate_limit_per_minute by Get Organization Info.

​
Attribution

Actions taken with an API key are attributed to the user who created the key. Several endpoints also accept an explicit user_email in the request body to attribute an action to a specific member of your organization instead.

​
Available endpoints

Everything under API Key Access in the navigation. Start with:

Get Organization Info

Your organization’s name, legal entities, and rate limit

Upload Document

Upload documents to Knowledge Center for processing

List Workflows

Every workflow available in your organization

Initiate Workflow

Start a new workflow task with specified variables

​
Security notes

An API key is organization-wide. Anyone holding it can read and modify any document, workflow, and task in your organization. Never ship a key in client-side code, a mobile app, or a browser extension - use an OAuth application with a public client for those.
Issue a separate key per integration. That way you can revoke one integration’s access, and read its usage, without disrupting the others.