Authentication

​

Authentication Method

​

Request Format

x-api-key: your-api-key-here

​

Getting Your API Key

​

API Key Format

• Format: API keys are prefixed with qapi_ followed by a secure random string
• Example: qapi_abc123def456ghi789jkl012mno345pqr678stu901vwx234yz
• Scope: API keys are scoped to your organization/team level
• Permissions: API keys inherit permissions from the organization/team they’re associated with

​

Example Requests

curl -X GET https://api.prod.qualifi.hr/qsi/gather/questions \
  -H "x-api-key: your-api-key-here"

const apiKey = 'your-api-key-here';

const response = await fetch('https://api.prod.qualifi.hr/qsi/gather/questions', {
  headers: {
    'x-api-key': apiKey
  }
});

const data = await response.json();

import requests

api_key = 'your-api-key-here'

response = requests.get(
    'https://api.prod.qualifi.hr/qsi/gather/questions',
    headers={'x-api-key': api_key}
)

data = response.json()

require 'net/http'

api_key = 'your-api-key-here'

uri = URI('https://api.prod.qualifi.hr/qsi/gather/questions')
req = Net::HTTP::Get.new(uri)
req['x-api-key'] = api_key

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) do |http|
  http.request(req)
end

​

Authorization Scope

• You can only access resources belonging to your organization
• API keys inherit permissions from the organization/team they’re associated with
• Multiple API keys can be created per organization/team
• API keys can be rotated or revoked independently
• The organization and team context is automatically determined from your API key

​

Error Responses

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Invalid API key"
  },
  "meta": {
    "requestId": "uuid",
    "timestamp": "2024-01-01T00:00:00Z"
  }
}

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Missing authentication header",
    "details": {
      "expectedFormat": "x-api-key header"
    }
  },
  "meta": {
    "requestId": "uuid",
    "timestamp": "2024-01-01T00:00:00Z"
  }
}

​

API Key Management

• Multiple Keys: Each organization/team can have multiple API keys
• Key Rotation: API keys can be rotated/revoked without affecting other keys
• Read-Only Keys: Support for read-only vs. read-write API keys (future enhancement)
• Team-Specific Keys: API keys can be scoped to specific teams within an organization

​

Best Practices

1. Environment Variables: Store API keys in environment variables
   Copy

   export GATHER_API_KEY="qapi_your-key-here"
   
2. Secure Storage: Use secret management tools (AWS Secrets Manager, HashiCorp Vault, etc.) in production
3. Key Rotation: Rotate API keys periodically for security
4. Separate Keys: Use different keys for different environments (production, staging)
5. Monitor Usage: Regularly review API key usage and revoke unused keys

​

Next Steps