Skip to main content
Every Public API request must include the API key as the value of the x-api-key HTTP header. Keys are tenant-scoped: a key issued to Partner A cannot read Partner B’s data.

​
Sending the key

Sending the key via Authorization: Bearer … is not supported — see Authentication errors for what each failure returns.

​
Getting a key

Authorized admin users create keys in the ProVision portal under Settings → Integrations → Developer.
  1. Open the Developer tab.
  2. Click Create key.
  3. Enter a name and select the operation scopes the integration needs.
  4. Copy the full key from the one-time reveal dialog and store it in your secret manager.
Keys are partner-scoped, not per user. Any integration using the key acts on behalf of your partner tenant. Choose the minimum scopes needed for your use case. The full key value is shown only at creation (and again after regeneration). If you lose it, use Regenerate key on the Developer tab to issue a new secret. If you do not see the Developer tab, ask a ProVision admin on your team to grant access or create a key for you. For help choosing scopes, email help@onevisionresources.com.

​
Authentication errors

Every error body uses the same envelope, including errors returned by the API gateway before your request reaches ProVision:
A newly created or regenerated key can take a few minutes to activate across the gateway, and during that window some requests may return 403 INVALID_API_KEY while others succeed. Retry those with backoff. When you report a problem, include the requestId from the error body (it is also returned in the x-amzn-RequestId response header) so we can trace the exact request.

​
Rotation and revocation

To rotate a key, open Settings → Integrations → Developer, choose the key, and select Regenerate key. Deploy the new secret to your integration before deleting the old value from your secret manager. To revoke a key immediately, choose Revoke key from the row menu. Revoked keys stay visible in the list with a REVOKED label but can no longer authenticate requests. If a key is leaked and you cannot sign in to the portal, email help@onevisionresources.com with the prefix of the key (the first eight characters) and the words “REVOKE NOW” in the subject line.

​
What the key proves

A valid key proves three things to the API:
  1. Tenancy. The key is bound to a partnerId in our internal database, and that is the only tenant the request can read or write.
  2. Allowed operations. The key carries a list of operation scopes (for example conversation:read) that gate each endpoint — see Permissions.
  3. Throttle bucket. The key counts against a per-key rate limit enforced at the API gateway — see Rate limits.