External API Authentication

Authenticate ChainPatrol External API requests with an X-API-KEY header, create an API key from your dashboard, and choose read-only or read & write access.

We use API keys to authenticate requests. Organization owners and admins can create one from Developer › API Keys in the ChainPatrol dashboard. See Get Your API Key for a walkthrough.

​

How to authenticate a request

To authenticate a request, you need to include a X-API-KEY header with the value of your API key in your request:

'X-API-KEY': '<your api key>'

​

Key permissions

Every API key has one of two permissions, chosen when you create it:

Permission	What the key can do
Read only (default)	Query and export data
Read & write	Everything a read-only key can, plus endpoints that change data

Submitting reports needs a Read & write key. So does every other endpoint that creates or changes data, such as Create Report, Asset Submit, Dispute Create, and adding, updating or removing organization assets and asset groups.

Calling one of these with a read-only key returns 403 Forbidden with a message like:

"reportCreate" changes data, and this API key is read-only. Create an API key with read & write access to make changes.

A key’s permission can’t be changed after it is created. To get write access, create a new key with Read & write selected, switch your integration to it, then revoke the old key.

Integration organizations can only create read-only keys. If your organization needs write access, email [e-mail].