Set up API access

Create named, project-scoped API keys so external systems integrate programmatically, authenticate requests with them, and revoke any key cleanly without disrupting the rest.

API access is how external systems integrate with TraceUnified programmatically — letting your other tools read and write data instead of everything happening through the interface. That access is governed by API keys you manage here: named, scoped, and revocable, so programmatic access stays as accountable as interactive access. For the reference, see API access.

Create a scoped API key

A key is created with a name and a scope, and the full value is shown only once.

Before you start Open Administration and go to API access. You'll need administrator access.

Create a key with a name that identifies its purpose; it's given a key prefix so you can recognize it later.
Give it a project scope where the integration only needs one project, so a key built for one project can't act across your whole organization.
Copy the full key when it's shown — it appears once, at creation, and for security isn't displayed again.

Result A named, scoped key for a single integration. See API access.

Authenticate requests with the key

The integrating system presents the key on each request.

Have the integrating system include its API key on each request, as described in the API documentation linked from this area.
Treat keys as secrets — scoped narrowly and stored securely by the system that uses them.

Result Programmatic access that's as controlled as interactive access.

Revoke a key when needed

Any key can be withdrawn the moment it’s no longer trusted.

Revoke any key that's no longer needed or might be compromised — revoking it immediately cuts off the access it granted.
Because each integration uses its own named key, retire one without affecting other keys or users; a revoked key is marked as such.

Result Access you can withdraw cleanly, with a clear record of what was issued and what was revoked.

Note Named, scoped, revocable keys are what keep programmatic access governed like everything else — so give each integration its own key rather than sharing one. A single shared key turns every revocation into a disruption; one key per integration is what makes withdrawing access safe.

Where to go next

API access and data import together complete how TraceUnified connects to the systems around it — one for programmatic reach, the other for bringing data in on a governed path.