Authorize application scopes, then use the method, path, and examples on each endpoint page to complete the integration.
Authorize application scopes, then use the method, path, and examples on each endpoint page to complete the integration.
API keys, scopes and organization boundaries.
Host, format and request tracing.
Common status codes and troubleshooting.
Server-side applications call APIs with an API Key created in Open Platform. The key identifies the app so the server can derive the trusted organization and granted scopes.
All endpoints share the headers below. Each endpoint page lists the headers required for its method and request body.
Store API Keys and other secrets only in a server-side secret manager. Never put them in browser code, logs, documentation, or screenshots.
Use the HTTP status and stable business error code to identify authentication, authorization, input, resource, or dependency failures.
Business error responses use the common error, detail, code and optional details fields. The request tracing identifier is returned in the X-Request-Id response header, not the response body. The table lists only implemented common or representative error codes.
Validate the request format and API Key first, then verify the endpoint scope and resource state. Back off and retry only for 503 or an explicitly retryable gateway error. A write retry must reuse the original Idempotency-Key and identical request content. Use the X-Request-Id response header to correlate logs and traces.
- Independent scopes: 53
- API operations: 130
- Permission type: read / manage / execute
Get started
- Create an app: Create or select an app in Open Platform.
- Grant scopes: Select the independent read, manage, or execute scopes required by the app.
- Create an API Key: The full credential is shown once. Store it securely right away.
- Build the request: Follow the endpoint page and retain the request ID for troubleshooting.
Authentication
API keys, scopes and organization boundaries.
Conventions
Host, format and request tracing.
Error handling
Common status codes and troubleshooting.
Authentication
Server-side applications call APIs with an API Key created in Open Platform. The key identifies the app so the server can derive the trusted organization and granted scopes.
Authentication and headers
All endpoints share the headers below. Each endpoint page lists the headers required for its method and request body.
| Name | Location | Type | Required | Description | Example |
|---|---|---|---|---|---|
| Authorization | header | string | Yes | Application API Key passed with the Bearer scheme. | Bearer <API_KEY> |
| X-Request-Id | header | string | No | Optional request tracing identifier; generated by the server when omitted. | req-20260831-001 |
| Content-Type | header | string | With a JSON body | Request media type; fixed to application/json. | application/json |
| Idempotency-Key | header | string | Per endpoint docs | Idempotency key required by selected write endpoints; use 1–128 printable ASCII characters and reuse it when retrying identical input. | idem-20260831-001 |
Error handling
Use the HTTP status and stable business error code to identify authentication, authorization, input, resource, or dependency failures.
Error code
Business error responses use the common error, detail, code and optional details fields. The request tracing identifier is returned in the X-Request-Id response header, not the response body. The table lists only implemented common or representative error codes.
| HTTP | Error type | Error code | Description | Retryable |
|---|---|---|---|---|
| 400 | BadRequest | request_validation_failed | Invalid request format such as Content-Type, JSON, or revision. | No |
| 401 | Unauthorized | openapi_invalid_api_key | The API Key is missing or invalid. | No |
| 403 | Forbidden | openapi_scope_denied | The API Key lacks the independent scope required by this endpoint. | No |
| 404 | NotFound | authn_openapi_not_enabled | The OpenAPI endpoint is disabled or not registered in the gateway catalog. | No |
| 404 | NotFound | department_not_found | The requested department does not exist; this is a currently implemented resource-error example. | No |
| 422 | UnprocessableEntity | request_validation_failed | Semantic validation failed for a UUID, pagination, fields, or Idempotency-Key. | No |
| 503 | ServiceUnavailable | iam_openapi_execution_unavailable | The internal IAM execution path or related OpenAPI capability is temporarily unavailable. | Yes |