Authentication

Every operation in the Catalogue API requires an agency API key. Besides granting access, the key determines pricing (through its price_vector) and which part of the catalogue is visible. The only routes that do not require a key are service routes outside the specification: the healthcheck, the CORS preflight and the documentation itself.

Sending the key

The key can be sent in either of two ways:

# X-API-Key header
curl https://agent-dev.azizdubai.com/whoIAm -H "X-API-Key: azk_<your key>"

# Authorization header with the Bearer scheme
curl https://agent-dev.azizdubai.com/whoIAm -H "Authorization: Bearer azk_<your key>"

A bare Authorization value without a scheme is also accepted. Any other scheme is ignored, in which case X-API-Key is read instead. A request without a key receives 401 missing api key; an unknown, revoked or deleted key receives 401 invalid api key.

Domain restriction

A key can be restricted to a list of domains. When the list is set, a request is accepted only if the host of its Origin header — or, if Origin is absent, its Referer header — exactly matches one of the listed domains. There is no wildcard matching: example.com does not cover www.example.com, so every subdomain must be listed individually.

Requests that carry neither header are rejected, which matters for server-side calls made with a restricted key. A request that fails the check receives 403 origin is not allowed for this api key. A key without a domain list is not restricted.

Agency licence

A key belongs to an agency, and the agency must hold an approved licence. Until it does, every operation answers 403 agency license is required: upload a company license and wait for its approval.

Visible developers

The catalogue a key sees consists only of developers the agency has an approved contract with. Other developers, their projects and units do not exist for the key: they are absent from GET /companies, GET /projects and GET /projects/list, while GET /projects/{id}, GET /projects/{id}/contacts, GET /units/{id} and POST /units/{id}/applications answer 404 for them — the same response as for a non-existent ID.