Authentication

Protected The Wo endpoints use API key authentication. Authentication is a shared platform capability. Individual products can use this same mechanism without redefining API key behavior inside each product. Operational Evidence currently uses this authentication model for both report generation and current-usage visibility. During the private beta, API keys are provisioned manually after access approval. See Operational Evidence beta access for the current onboarding process. Send your API key through the following HTTP header:

x-api-key: <your-api-key>

For example:

POST /v1/evidence/reports
content-type: application/json
x-api-key: <your-api-key>

API keys are secrets

An API key authenticates your integration and must be treated as a secret credential. Do not:

commit API keys to source control;
include API keys in public documentation;
include API keys in screenshots;
send API keys through query parameters;
write raw API keys to ordinary application logs;
embed API keys in publicly distributed frontend code;
embed API keys in publicly distributed mobile applications.

The current API key model is intended for trusted server-to-server integrations. Store the credential in a server-side secret manager or environment variable appropriate for your deployment environment.

Missing API key

Requests to protected endpoints without the x-api-key header are rejected before the business operation is executed. Example response:

HTTP/1.1 401 Unauthorized
content-type: application/json

{
  "error": {
    "code": "missing_api_key",
    "message": "The x-api-key header is required.",
    "requestId": "req_123"
  }
}

Invalid API key

Invalid, inactive, or revoked credentials are represented through the same public error. This prevents API consumers from learning the internal lifecycle state of a credential. Example:

HTTP/1.1 401 Unauthorized
content-type: application/json

{
  "error": {
    "code": "invalid_api_key",
    "message": "The provided API key is invalid.",
    "requestId": "req_123"
  }
}

Authentication service unavailable

If the API cannot safely validate a credential because the authentication service is temporarily unavailable, the request fails closed.

HTTP/1.1 503 Service Unavailable

The public error code is:

api_key_authentication_unavailable

The protected operation is not executed when authentication cannot be completed reliably.

Request IDs

Error responses include a requestId. Keep this value when reporting an integration problem because it can be used to correlate the failed request without exposing the API key itself.

Product onboarding

Authentication describes how a credential is used after it has been issued. For the currently available product, continue to Operational Evidence beta access to understand manual approval and provisioning.

Start here

Shared platform

Authentication

Authentication

API keys are secrets

Missing API key

Invalid API key

Authentication service unavailable

Request IDs

Product onboarding

​Authentication

​API keys are secrets

​Missing API key

​Invalid API key

​Authentication service unavailable

​Request IDs

​Product onboarding

Authentication

API keys are secrets

Missing API key

Invalid API key

Authentication service unavailable

Request IDs

Product onboarding