Skip to Content
API ReferenceAuthentication

Authentication

All API requests require a Bearer token in the Authorization header.

Creating an API Key

  1. Go to Settings → API Keys in the ScendCore dashboard
  2. Click Create API Key
  3. Copy the key — it is shown only once

Using the Key

curl https://app.scendcore.com/api/v1/contacts \
  -H "Authorization: Bearer sk_your_api_key_here" \
  -H "Content-Type: application/json"

Scopes

Each API key has specific scopes that control what it can access:

ScopeGrants Access To
contacts:readGET /contacts
contacts:writePOST /contacts, PATCH /contacts/:id
opportunities:readGET /opportunities
opportunities:writePOST /opportunities, PATCH /opportunities/:id
sequences:readGET /sequences
sequences:writePOST /sequences/enroll
custom_fields:readGET /custom-fields
custom_fields:writePOST /custom-fields
conversations:readGET /conversations
conversations:writePOST /conversations
notes:writePOST /notes
webhooks:writeGET/POST /webhooks/subscribe

If a key lacks the required scope, the API returns 403 Forbidden.

Security

  • API keys are SHA-256 hashed — the plaintext is never stored
  • Every request is tenant-isolated — keys can only access their own tenant’s data
  • Keys can be revoked instantly from Settings → API Keys
  • All mutating calls are audit-logged with the key ID, endpoint, and timestamp
Last updated on
OverviewContacts