{ "item": [ { "id": "8dba4401-5e8b-47f2-5318-2b974e442e78", "name": "Connection", "description": { "content": "Verify a key and identify its organisation.", "type": "text/plain" }, "item": [ { "id": "b8f2fe18-a526-2f80-c6c3-dccbe3037c92", "name": "Generate a strong credential", "request": { "name": "Generate a strong credential", "description": { "content": "Returns a freshly generated password or passphrase. Nothing is stored, logged or associated with any request — it is a convenience for composing a credential to hand off. Any scope.", "type": "text/plain" }, "url": { "path": [ "generate" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"type\": \"passphrase\"\n}", "options": { "raw": { "language": "json" } } } }, "response": [ { "id": "9da0ae48-0c9a-ce32-35e7-04356995d2e9", "name": "The generated credential.", "originalRequest": { "url": { "path": [ "generate" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"type\": \"password\",\n \"length\": 20,\n \"lower\": true,\n \"upper\": true,\n \"digits\": true,\n \"symbols\": false\n}", "options": { "raw": { "language": "json" } } } }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"object\": \"\",\n \"type\": \"\",\n \"value\": \"\",\n \"length\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "2066462e-4de8-72f9-80bd-203e11b7618e", "name": "Missing, unknown, revoked or expired API key.", "originalRequest": { "url": { "path": [ "generate" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"type\": \"password\",\n \"length\": 20,\n \"lower\": true,\n \"upper\": true,\n \"digits\": true,\n \"symbols\": false\n}", "options": { "raw": { "language": "json" } } } }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "a2ef8bac-2412-7fc5-f502-7964f9e65285", "name": "The body or query is invalid (`errors` lists the fields), or an Idempotency-Key was reused with a different body.", "originalRequest": { "url": { "path": [ "generate" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"type\": \"password\",\n \"length\": 20,\n \"lower\": true,\n \"upper\": true,\n \"digits\": true,\n \"symbols\": false\n}", "options": { "raw": { "language": "json" } } } }, "status": "Unprocessable Entity (WebDAV) (RFC 4918)", "code": 422, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\",\n \"errors\": {\n \"key_0\": [\n \"\",\n \"\"\n ],\n \"key_1\": [\n \"\",\n \"\"\n ]\n }\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "3d27f836-ca8c-930d-1fff-d7799b7f0602", "name": "Check the API key", "request": { "name": "Check the API key", "description": { "content": "Returns the organisation and the key's scopes. Any scope; used by connectors as the connection test and label.", "type": "text/plain" }, "url": { "path": [ "ping" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "GET" }, "response": [ { "id": "2d118080-4bd8-24c6-0b41-97ec9109c491", "name": "The key is valid.", "originalRequest": { "url": { "path": [ "ping" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"ok\": \"\",\n \"organisation\": {\n \"id\": \"\",\n \"name\": \"\"\n },\n \"key\": {\n \"name\": \"\",\n \"prefix\": \"\",\n \"scopes\": [\n \"\",\n \"\"\n ],\n \"client\": \"\",\n \"expires_at\": \"\"\n },\n \"label\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "51672355-628c-b28d-f704-b3eb7fb8c555", "name": "Missing, unknown, revoked or expired API key.", "originalRequest": { "url": { "path": [ "ping" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } } ], "event": [] }, { "id": "2a75ea5e-c957-b673-253b-e347d0733874", "name": "Requests", "description": { "content": "Credential handoff requests.", "type": "text/plain" }, "item": [ { "id": "3bea19cd-e82b-b66b-21d4-d69b296b35e2", "name": "List requests", "request": { "name": "List requests", "description": { "content": "Newest first, cursor-paginated. Drafts are never listed. A client-scoped key only sees its client's requests.", "type": "text/plain" }, "url": { "path": [ "requests" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": true, "key": "status", "value": "pending" }, { "disabled": true, "key": "client_id", "value": "01j9z3k5m7p9r2t4v6x8y0a2b4" }, { "disabled": true, "key": "ticket_ref", "value": "string" }, { "disabled": true, "key": "limit", "value": "50" }, { "disabled": true, "key": "cursor", "value": "01j9z3k5m7p9r2t4v6x8y0a2b4", "description": "`next_cursor` from the previous page." } ], "variable": [] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "GET" }, "response": [ { "id": "ae042e9f-2f0f-d79c-50c7-ac8b29eddb59", "name": "A page of requests.", "originalRequest": { "url": { "path": [ "requests" ], "host": [ "{{baseUrl}}" ], "query": [ { "key": "status", "value": "" }, { "key": "client_id", "value": "" }, { "key": "ticket_ref", "value": "" }, { "key": "limit", "value": "50" }, { "key": "cursor", "value": "" } ], "variable": [] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"object\": \"\",\n \"data\": [\n {\n \"id\": \"\",\n \"object\": \"\",\n \"status\": \"\",\n \"client\": {\n \"id\": \"\",\n \"name\": \"\"\n },\n \"subject\": {\n \"name\": \"\",\n \"email\": \"\",\n \"phone\": \"\"\n },\n \"created_at\": \"\",\n \"ticket\": \"\",\n \"justification\": \"\",\n \"template\": \"\",\n \"requester\": {\n \"membership_id\": \"\",\n \"name\": \"\",\n \"email\": \"\"\n },\n \"recipients\": [\n {\n \"label\": \"\",\n \"membership_id\": \"\"\n },\n {\n \"label\": \"\",\n \"membership_id\": \"\"\n }\n ],\n \"ttl_minutes\": \"\",\n \"verification_mode\": \"\",\n \"allow_attachments\": \"\",\n \"attachments_count\": \"\",\n \"needs_relink\": \"\",\n \"unrecoverable\": \"\",\n \"reveal_count\": \"\",\n \"purge_reason\": \"\",\n \"revoked_reason\": \"\",\n \"link_expires_at\": \"\",\n \"opened_at\": \"\",\n \"submitted_at\": \"\",\n \"record_expires_at\": \"\",\n \"last_revealed_at\": \"\",\n \"purge_scheduled_at\": \"\",\n \"completed_at\": \"\",\n \"revoked_at\": \"\",\n \"links\": {\n \"self\": \"\",\n \"app\": \"\"\n }\n },\n {\n \"id\": \"\",\n \"object\": \"\",\n \"status\": \"\",\n \"client\": {\n \"id\": \"\",\n \"name\": \"\"\n },\n \"subject\": {\n \"name\": \"\",\n \"email\": \"\",\n \"phone\": \"\"\n },\n \"created_at\": \"\",\n \"ticket\": \"\",\n \"justification\": \"\",\n \"template\": \"\",\n \"requester\": {\n \"membership_id\": \"\",\n \"name\": \"\",\n \"email\": \"\"\n },\n \"recipients\": [\n {\n \"label\": \"\",\n \"membership_id\": \"\"\n },\n {\n \"label\": \"\",\n \"membership_id\": \"\"\n }\n ],\n \"ttl_minutes\": \"\",\n \"verification_mode\": \"\",\n \"allow_attachments\": \"\",\n \"attachments_count\": \"\",\n \"needs_relink\": \"\",\n \"unrecoverable\": \"\",\n \"reveal_count\": \"\",\n \"purge_reason\": \"\",\n \"revoked_reason\": \"\",\n \"link_expires_at\": \"\",\n \"opened_at\": \"\",\n \"submitted_at\": \"\",\n \"record_expires_at\": \"\",\n \"last_revealed_at\": \"\",\n \"purge_scheduled_at\": \"\",\n \"completed_at\": \"\",\n \"revoked_at\": \"\",\n \"links\": {\n \"self\": \"\",\n \"app\": \"\"\n }\n }\n ],\n \"has_more\": \"\",\n \"next_cursor\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "a3ee70ba-2367-af07-92df-e5f2fb2274e2", "name": "Missing, unknown, revoked or expired API key.", "originalRequest": { "url": { "path": [ "requests" ], "host": [ "{{baseUrl}}" ], "query": [ { "key": "status", "value": "" }, { "key": "client_id", "value": "" }, { "key": "ticket_ref", "value": "" }, { "key": "limit", "value": "50" }, { "key": "cursor", "value": "" } ], "variable": [] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "8c64480e-f93a-0f4d-d113-1d50ca0bb889", "name": "The key lacks the scope, is scoped to another client, or is used from an address outside its allowlist.", "originalRequest": { "url": { "path": [ "requests" ], "host": [ "{{baseUrl}}" ], "query": [ { "key": "status", "value": "" }, { "key": "client_id", "value": "" }, { "key": "ticket_ref", "value": "" }, { "key": "limit", "value": "50" }, { "key": "cursor", "value": "" } ], "variable": [] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Forbidden", "code": 403, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "62bac762-4ccd-c8f6-c783-391d09827571", "name": "The body or query is invalid (`errors` lists the fields), or an Idempotency-Key was reused with a different body.", "originalRequest": { "url": { "path": [ "requests" ], "host": [ "{{baseUrl}}" ], "query": [ { "key": "status", "value": "" }, { "key": "client_id", "value": "" }, { "key": "ticket_ref", "value": "" }, { "key": "limit", "value": "50" }, { "key": "cursor", "value": "" } ], "variable": [] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Unprocessable Entity (WebDAV) (RFC 4918)", "code": 422, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\",\n \"errors\": {\n \"key_0\": [\n \"\",\n \"\"\n ],\n \"key_1\": [\n \"\",\n \"\"\n ]\n }\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "d2bf5401-16b0-ab95-3401-bcf79d83b54f", "name": "Create a request", "request": { "name": "Create a request", "description": { "content": "Creates and commits a request in one call. Recipients are members of your organisation, addressed by email; each must have set up an identity key. The requester defaults to the first recipient. The response carries the complete link (fragment included) and, when the verification mode calls for one, the spoken challenge code — hand that to the subject out of band, never in the same message as the link.", "type": "text/plain" }, "url": { "path": [ "requests" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": true, "description": "Any unique string (≤ 200 characters) to make this POST safe to retry.", "key": "Idempotency-Key", "value": "{{$guid}}" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"subject_name\": \"Jane Smith\",\n \"subject_email\": \"jane@example.com\",\n \"justification\": \"Finance mailbox password reset after a lockout\",\n \"recipients\": [\n \"tech@example.com\"\n ],\n \"ticket_ref\": \"INC-12345\",\n \"delivery\": {\n \"method\": \"email\"\n }\n}", "options": { "raw": { "language": "json" } } } }, "response": [ { "id": "4a729393-c523-95d2-8e43-812b391ea95d", "name": "Created and committed.", "originalRequest": { "url": { "path": [ "requests" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "disabled": true, "description": "Any unique string (≤ 200 characters) to make this POST safe to retry.", "key": "Idempotency-Key", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"subject_name\": \"\",\n \"justification\": \"\",\n \"recipients\": [\n \"\"\n ],\n \"subject_email\": \"\",\n \"subject_phone\": \"\",\n \"requester\": \"\",\n \"teams\": [\n \"\",\n \"\"\n ],\n \"client_id\": \"\",\n \"preset\": \"\",\n \"template_id\": \"\",\n \"ticket_ref\": \"\",\n \"ticket_url\": \"\",\n \"ticket_integration_id\": \"\",\n \"ticket_external_id\": \"\",\n \"ttl_minutes\": \"\",\n \"verification_mode\": \"\",\n \"allow_attachments\": false,\n \"delivery\": {\n \"method\": \"none\"\n }\n}", "options": { "raw": { "language": "json" } } } }, "status": "Created", "code": 201, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"request\": {\n \"id\": \"\",\n \"object\": \"\",\n \"status\": \"\",\n \"client\": {\n \"id\": \"\",\n \"name\": \"\"\n },\n \"subject\": {\n \"name\": \"\",\n \"email\": \"\",\n \"phone\": \"\"\n },\n \"created_at\": \"\",\n \"ticket\": \"\",\n \"justification\": \"\",\n \"template\": \"\",\n \"requester\": {\n \"membership_id\": \"\",\n \"name\": \"\",\n \"email\": \"\"\n },\n \"recipients\": [\n {\n \"label\": \"\",\n \"membership_id\": \"\"\n },\n {\n \"label\": \"\",\n \"membership_id\": \"\"\n }\n ],\n \"ttl_minutes\": \"\",\n \"verification_mode\": \"\",\n \"allow_attachments\": \"\",\n \"attachments_count\": \"\",\n \"needs_relink\": \"\",\n \"unrecoverable\": \"\",\n \"reveal_count\": \"\",\n \"purge_reason\": \"\",\n \"revoked_reason\": \"\",\n \"link_expires_at\": \"\",\n \"opened_at\": \"\",\n \"submitted_at\": \"\",\n \"record_expires_at\": \"\",\n \"last_revealed_at\": \"\",\n \"purge_scheduled_at\": \"\",\n \"completed_at\": \"\",\n \"revoked_at\": \"\",\n \"links\": {\n \"self\": \"\",\n \"app\": \"\"\n }\n },\n \"link\": \"\",\n \"commit\": \"\",\n \"commitment\": {\n \"computed_by\": \"\",\n \"note\": \"\"\n },\n \"link_without_fragment\": \"\",\n \"challenge_code\": \"\",\n \"delivery\": \"\",\n \"excluded_recipients\": [\n \"\",\n \"\"\n ]\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "ff4d8ac3-d3ab-65ba-0851-4445c2db718c", "name": "Missing, unknown, revoked or expired API key.", "originalRequest": { "url": { "path": [ "requests" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "disabled": true, "description": "Any unique string (≤ 200 characters) to make this POST safe to retry.", "key": "Idempotency-Key", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"subject_name\": \"\",\n \"justification\": \"\",\n \"recipients\": [\n \"\"\n ],\n \"subject_email\": \"\",\n \"subject_phone\": \"\",\n \"requester\": \"\",\n \"teams\": [\n \"\",\n \"\"\n ],\n \"client_id\": \"\",\n \"preset\": \"\",\n \"template_id\": \"\",\n \"ticket_ref\": \"\",\n \"ticket_url\": \"\",\n \"ticket_integration_id\": \"\",\n \"ticket_external_id\": \"\",\n \"ttl_minutes\": \"\",\n \"verification_mode\": \"\",\n \"allow_attachments\": false,\n \"delivery\": {\n \"method\": \"none\"\n }\n}", "options": { "raw": { "language": "json" } } } }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "e0f077ad-f4d5-e9bb-d42a-80c24d79841d", "name": "The key lacks the scope, is scoped to another client, or is used from an address outside its allowlist.", "originalRequest": { "url": { "path": [ "requests" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "disabled": true, "description": "Any unique string (≤ 200 characters) to make this POST safe to retry.", "key": "Idempotency-Key", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"subject_name\": \"\",\n \"justification\": \"\",\n \"recipients\": [\n \"\"\n ],\n \"subject_email\": \"\",\n \"subject_phone\": \"\",\n \"requester\": \"\",\n \"teams\": [\n \"\",\n \"\"\n ],\n \"client_id\": \"\",\n \"preset\": \"\",\n \"template_id\": \"\",\n \"ticket_ref\": \"\",\n \"ticket_url\": \"\",\n \"ticket_integration_id\": \"\",\n \"ticket_external_id\": \"\",\n \"ttl_minutes\": \"\",\n \"verification_mode\": \"\",\n \"allow_attachments\": false,\n \"delivery\": {\n \"method\": \"none\"\n }\n}", "options": { "raw": { "language": "json" } } } }, "status": "Forbidden", "code": 403, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "9cea8ce2-c90f-b6f7-ea5f-9a7b4bc1716e", "name": "The state does not allow this transition, or an Idempotency-Key is still being processed.", "originalRequest": { "url": { "path": [ "requests" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "disabled": true, "description": "Any unique string (≤ 200 characters) to make this POST safe to retry.", "key": "Idempotency-Key", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"subject_name\": \"\",\n \"justification\": \"\",\n \"recipients\": [\n \"\"\n ],\n \"subject_email\": \"\",\n \"subject_phone\": \"\",\n \"requester\": \"\",\n \"teams\": [\n \"\",\n \"\"\n ],\n \"client_id\": \"\",\n \"preset\": \"\",\n \"template_id\": \"\",\n \"ticket_ref\": \"\",\n \"ticket_url\": \"\",\n \"ticket_integration_id\": \"\",\n \"ticket_external_id\": \"\",\n \"ttl_minutes\": \"\",\n \"verification_mode\": \"\",\n \"allow_attachments\": false,\n \"delivery\": {\n \"method\": \"none\"\n }\n}", "options": { "raw": { "language": "json" } } } }, "status": "Conflict", "code": 409, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "83063339-5aeb-d278-cff2-e23192079798", "name": "The body or query is invalid (`errors` lists the fields), or an Idempotency-Key was reused with a different body.", "originalRequest": { "url": { "path": [ "requests" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "disabled": true, "description": "Any unique string (≤ 200 characters) to make this POST safe to retry.", "key": "Idempotency-Key", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"subject_name\": \"\",\n \"justification\": \"\",\n \"recipients\": [\n \"\"\n ],\n \"subject_email\": \"\",\n \"subject_phone\": \"\",\n \"requester\": \"\",\n \"teams\": [\n \"\",\n \"\"\n ],\n \"client_id\": \"\",\n \"preset\": \"\",\n \"template_id\": \"\",\n \"ticket_ref\": \"\",\n \"ticket_url\": \"\",\n \"ticket_integration_id\": \"\",\n \"ticket_external_id\": \"\",\n \"ttl_minutes\": \"\",\n \"verification_mode\": \"\",\n \"allow_attachments\": false,\n \"delivery\": {\n \"method\": \"none\"\n }\n}", "options": { "raw": { "language": "json" } } } }, "status": "Unprocessable Entity (WebDAV) (RFC 4918)", "code": 422, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\",\n \"errors\": {\n \"key_0\": [\n \"\",\n \"\"\n ],\n \"key_1\": [\n \"\",\n \"\"\n ]\n }\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "51b76b0b-a670-0565-d599-d38b684a8f44", "name": "Get a request", "request": { "name": "Get a request", "description": {}, "url": { "path": [ "requests", ":id" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "type": "any", "value": "01j9z3k5m7p9r2t4v6x8y0a2b4", "key": "id", "description": "(Required) " } ] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "GET" }, "response": [ { "id": "050b2ee4-ea6f-8a8e-cc2a-ed3422fd491f", "name": "The request.", "originalRequest": { "url": { "path": [ "requests", ":id" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "type": "any", "value": "01j9z3k5m7p9r2t4v6x8y0a2b4", "key": "id", "description": "(Required) " } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"id\": \"\",\n \"object\": \"\",\n \"status\": \"\",\n \"client\": {\n \"id\": \"\",\n \"name\": \"\"\n },\n \"subject\": {\n \"name\": \"\",\n \"email\": \"\",\n \"phone\": \"\"\n },\n \"created_at\": \"\",\n \"ticket\": \"\",\n \"justification\": \"\",\n \"template\": \"\",\n \"requester\": {\n \"membership_id\": \"\",\n \"name\": \"\",\n \"email\": \"\"\n },\n \"recipients\": [\n {\n \"label\": \"\",\n \"membership_id\": \"\"\n },\n {\n \"label\": \"\",\n \"membership_id\": \"\"\n }\n ],\n \"ttl_minutes\": \"\",\n \"verification_mode\": \"\",\n \"allow_attachments\": \"\",\n \"attachments_count\": \"\",\n \"needs_relink\": \"\",\n \"unrecoverable\": \"\",\n \"reveal_count\": \"\",\n \"purge_reason\": \"\",\n \"revoked_reason\": \"\",\n \"link_expires_at\": \"\",\n \"opened_at\": \"\",\n \"submitted_at\": \"\",\n \"record_expires_at\": \"\",\n \"last_revealed_at\": \"\",\n \"purge_scheduled_at\": \"\",\n \"completed_at\": \"\",\n \"revoked_at\": \"\",\n \"links\": {\n \"self\": \"\",\n \"app\": \"\"\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "9344eedb-a150-29c9-3941-d62eb99e488e", "name": "Missing, unknown, revoked or expired API key.", "originalRequest": { "url": { "path": [ "requests", ":id" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "type": "any", "value": "01j9z3k5m7p9r2t4v6x8y0a2b4", "key": "id", "description": "(Required) " } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "2aefdc7c-d584-253a-e8d6-9dc5762d1b1f", "name": "The key lacks the scope, is scoped to another client, or is used from an address outside its allowlist.", "originalRequest": { "url": { "path": [ "requests", ":id" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "type": "any", "value": "01j9z3k5m7p9r2t4v6x8y0a2b4", "key": "id", "description": "(Required) " } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Forbidden", "code": 403, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "227075db-d91d-c14a-3f76-711afda1bb63", "name": "No such record within this key's scope.", "originalRequest": { "url": { "path": [ "requests", ":id" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "type": "any", "value": "01j9z3k5m7p9r2t4v6x8y0a2b4", "key": "id", "description": "(Required) " } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Not Found", "code": 404, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "b51afd1d-09cd-5b91-a391-b2c8f3725d9c", "name": "Revoke a live link", "request": { "name": "Revoke a live link", "description": { "content": "Kills the link before the subject submits. Only `pending` and `opened` requests can be revoked; anything else answers 409 `illegal_transition`.", "type": "text/plain" }, "url": { "path": [ "requests", ":id", "revoke" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "type": "any", "value": "01j9z3k5m7p9r2t4v6x8y0a2b4", "key": "id", "description": "(Required) " } ] }, "header": [ { "disabled": true, "description": "Any unique string (≤ 200 characters) to make this POST safe to retry.", "key": "Idempotency-Key", "value": "{{$guid}}" }, { "key": "Accept", "value": "application/json" } ], "method": "POST" }, "response": [ { "id": "a3e6ed0d-73fb-b82b-451d-b8cd9a8a68ce", "name": "Revoked.", "originalRequest": { "url": { "path": [ "requests", ":id", "revoke" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "type": "any", "value": "01j9z3k5m7p9r2t4v6x8y0a2b4", "key": "id", "description": "(Required) " } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "disabled": true, "description": "Any unique string (≤ 200 characters) to make this POST safe to retry.", "key": "Idempotency-Key", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"id\": \"\",\n \"object\": \"\",\n \"status\": \"\",\n \"client\": {\n \"id\": \"\",\n \"name\": \"\"\n },\n \"subject\": {\n \"name\": \"\",\n \"email\": \"\",\n \"phone\": \"\"\n },\n \"created_at\": \"\",\n \"ticket\": \"\",\n \"justification\": \"\",\n \"template\": \"\",\n \"requester\": {\n \"membership_id\": \"\",\n \"name\": \"\",\n \"email\": \"\"\n },\n \"recipients\": [\n {\n \"label\": \"\",\n \"membership_id\": \"\"\n },\n {\n \"label\": \"\",\n \"membership_id\": \"\"\n }\n ],\n \"ttl_minutes\": \"\",\n \"verification_mode\": \"\",\n \"allow_attachments\": \"\",\n \"attachments_count\": \"\",\n \"needs_relink\": \"\",\n \"unrecoverable\": \"\",\n \"reveal_count\": \"\",\n \"purge_reason\": \"\",\n \"revoked_reason\": \"\",\n \"link_expires_at\": \"\",\n \"opened_at\": \"\",\n \"submitted_at\": \"\",\n \"record_expires_at\": \"\",\n \"last_revealed_at\": \"\",\n \"purge_scheduled_at\": \"\",\n \"completed_at\": \"\",\n \"revoked_at\": \"\",\n \"links\": {\n \"self\": \"\",\n \"app\": \"\"\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "f81e64a7-2f79-9035-d9ba-f70b208a6efc", "name": "Missing, unknown, revoked or expired API key.", "originalRequest": { "url": { "path": [ "requests", ":id", "revoke" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "type": "any", "value": "01j9z3k5m7p9r2t4v6x8y0a2b4", "key": "id", "description": "(Required) " } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "disabled": true, "description": "Any unique string (≤ 200 characters) to make this POST safe to retry.", "key": "Idempotency-Key", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": {} }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "67842cb4-64eb-c4ca-27e7-64c43f812c3f", "name": "The key lacks the scope, is scoped to another client, or is used from an address outside its allowlist.", "originalRequest": { "url": { "path": [ "requests", ":id", "revoke" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "type": "any", "value": "01j9z3k5m7p9r2t4v6x8y0a2b4", "key": "id", "description": "(Required) " } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "disabled": true, "description": "Any unique string (≤ 200 characters) to make this POST safe to retry.", "key": "Idempotency-Key", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": {} }, "status": "Forbidden", "code": 403, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "4fb02c63-1506-e799-b386-214b6cc0bea6", "name": "No such record within this key's scope.", "originalRequest": { "url": { "path": [ "requests", ":id", "revoke" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "type": "any", "value": "01j9z3k5m7p9r2t4v6x8y0a2b4", "key": "id", "description": "(Required) " } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "disabled": true, "description": "Any unique string (≤ 200 characters) to make this POST safe to retry.", "key": "Idempotency-Key", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": {} }, "status": "Not Found", "code": 404, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "436e9664-e42d-45a4-11a6-72be73940175", "name": "The state does not allow this transition, or an Idempotency-Key is still being processed.", "originalRequest": { "url": { "path": [ "requests", ":id", "revoke" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "type": "any", "value": "01j9z3k5m7p9r2t4v6x8y0a2b4", "key": "id", "description": "(Required) " } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "disabled": true, "description": "Any unique string (≤ 200 characters) to make this POST safe to retry.", "key": "Idempotency-Key", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": {} }, "status": "Conflict", "code": 409, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "b9c29cab-5d63-727f-e544-fdda58debca5", "name": "Complete a request and destroy the credential", "request": { "name": "Complete a request and destroy the credential", "description": { "content": "Purges the stored envelope and attachments of a `submitted` request and marks it completed. Irreversible. Other states answer 409 `illegal_transition`.", "type": "text/plain" }, "url": { "path": [ "requests", ":id", "complete" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "type": "any", "value": "01j9z3k5m7p9r2t4v6x8y0a2b4", "key": "id", "description": "(Required) " } ] }, "header": [ { "disabled": true, "description": "Any unique string (≤ 200 characters) to make this POST safe to retry.", "key": "Idempotency-Key", "value": "{{$guid}}" }, { "key": "Accept", "value": "application/json" } ], "method": "POST" }, "response": [ { "id": "9b2780d1-5463-6528-b5d2-b33a2744d847", "name": "Completed.", "originalRequest": { "url": { "path": [ "requests", ":id", "complete" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "type": "any", "value": "01j9z3k5m7p9r2t4v6x8y0a2b4", "key": "id", "description": "(Required) " } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "disabled": true, "description": "Any unique string (≤ 200 characters) to make this POST safe to retry.", "key": "Idempotency-Key", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"id\": \"\",\n \"object\": \"\",\n \"status\": \"\",\n \"client\": {\n \"id\": \"\",\n \"name\": \"\"\n },\n \"subject\": {\n \"name\": \"\",\n \"email\": \"\",\n \"phone\": \"\"\n },\n \"created_at\": \"\",\n \"ticket\": \"\",\n \"justification\": \"\",\n \"template\": \"\",\n \"requester\": {\n \"membership_id\": \"\",\n \"name\": \"\",\n \"email\": \"\"\n },\n \"recipients\": [\n {\n \"label\": \"\",\n \"membership_id\": \"\"\n },\n {\n \"label\": \"\",\n \"membership_id\": \"\"\n }\n ],\n \"ttl_minutes\": \"\",\n \"verification_mode\": \"\",\n \"allow_attachments\": \"\",\n \"attachments_count\": \"\",\n \"needs_relink\": \"\",\n \"unrecoverable\": \"\",\n \"reveal_count\": \"\",\n \"purge_reason\": \"\",\n \"revoked_reason\": \"\",\n \"link_expires_at\": \"\",\n \"opened_at\": \"\",\n \"submitted_at\": \"\",\n \"record_expires_at\": \"\",\n \"last_revealed_at\": \"\",\n \"purge_scheduled_at\": \"\",\n \"completed_at\": \"\",\n \"revoked_at\": \"\",\n \"links\": {\n \"self\": \"\",\n \"app\": \"\"\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "8d3e277c-fba3-d7e5-f5fb-3d68a3b188eb", "name": "Missing, unknown, revoked or expired API key.", "originalRequest": { "url": { "path": [ "requests", ":id", "complete" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "type": "any", "value": "01j9z3k5m7p9r2t4v6x8y0a2b4", "key": "id", "description": "(Required) " } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "disabled": true, "description": "Any unique string (≤ 200 characters) to make this POST safe to retry.", "key": "Idempotency-Key", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": {} }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "863fd38f-3f92-b35e-4999-5e79269094f1", "name": "The key lacks the scope, is scoped to another client, or is used from an address outside its allowlist.", "originalRequest": { "url": { "path": [ "requests", ":id", "complete" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "type": "any", "value": "01j9z3k5m7p9r2t4v6x8y0a2b4", "key": "id", "description": "(Required) " } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "disabled": true, "description": "Any unique string (≤ 200 characters) to make this POST safe to retry.", "key": "Idempotency-Key", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": {} }, "status": "Forbidden", "code": 403, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "c2e5d5da-5c5b-59af-62df-99d148c508d2", "name": "No such record within this key's scope.", "originalRequest": { "url": { "path": [ "requests", ":id", "complete" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "type": "any", "value": "01j9z3k5m7p9r2t4v6x8y0a2b4", "key": "id", "description": "(Required) " } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "disabled": true, "description": "Any unique string (≤ 200 characters) to make this POST safe to retry.", "key": "Idempotency-Key", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": {} }, "status": "Not Found", "code": 404, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "0421ad18-94b8-df44-4e83-faa07641c029", "name": "The state does not allow this transition, or an Idempotency-Key is still being processed.", "originalRequest": { "url": { "path": [ "requests", ":id", "complete" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "type": "any", "value": "01j9z3k5m7p9r2t4v6x8y0a2b4", "key": "id", "description": "(Required) " } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "disabled": true, "description": "Any unique string (≤ 200 characters) to make this POST safe to retry.", "key": "Idempotency-Key", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": {} }, "status": "Conflict", "code": 409, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "7ea7f492-5381-e806-313b-c5361318ab3c", "name": "Download a chain-of-custody certificate", "request": { "name": "Download a chain-of-custody certificate", "description": { "content": "A signed, offline-verifiable evidence document (`safehanded-custody/v1`) for one request: who requested it, whose key it was sealed to (fingerprints), and when it was submitted, revealed and purged. JSON by default (verify it with the published `tools/verify-custody-certificate`), or a rendered PDF with `?format=pdf`. Contains no secret material.", "type": "text/plain" }, "url": { "path": [ "requests", ":id", "certificate" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": true, "key": "format", "value": "json", "description": "json (default, signed and verifiable) or pdf (a rendered document)." } ], "variable": [ { "disabled": false, "type": "any", "value": "01j9z3k5m7p9r2t4v6x8y0a2b4", "key": "id", "description": "(Required) " } ] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "GET" }, "response": [ { "id": "b5dc0dcc-0f41-e67f-385c-2c6d020ed8dd", "name": "The chain-of-custody certificate. A safehanded-custody/v1 JSON document by default, or application/pdf when format=pdf.", "originalRequest": { "url": { "path": [ "requests", ":id", "certificate" ], "host": [ "{{baseUrl}}" ], "query": [ { "key": "format", "value": "json" } ], "variable": [ { "disabled": false, "type": "any", "value": "01j9z3k5m7p9r2t4v6x8y0a2b4", "key": "id", "description": "(Required) " } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "\"\"", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "6d1c6a4b-fa6a-5e9e-573d-5dbf2923440b", "name": "Missing, unknown, revoked or expired API key.", "originalRequest": { "url": { "path": [ "requests", ":id", "certificate" ], "host": [ "{{baseUrl}}" ], "query": [ { "key": "format", "value": "json" } ], "variable": [ { "disabled": false, "type": "any", "value": "01j9z3k5m7p9r2t4v6x8y0a2b4", "key": "id", "description": "(Required) " } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "5fa9ff83-c500-a23e-689c-c490ab79180a", "name": "The key lacks the scope, is scoped to another client, or is used from an address outside its allowlist.", "originalRequest": { "url": { "path": [ "requests", ":id", "certificate" ], "host": [ "{{baseUrl}}" ], "query": [ { "key": "format", "value": "json" } ], "variable": [ { "disabled": false, "type": "any", "value": "01j9z3k5m7p9r2t4v6x8y0a2b4", "key": "id", "description": "(Required) " } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Forbidden", "code": 403, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "635fc985-94e6-b279-bc8e-f75b61f75e48", "name": "No such record within this key's scope.", "originalRequest": { "url": { "path": [ "requests", ":id", "certificate" ], "host": [ "{{baseUrl}}" ], "query": [ { "key": "format", "value": "json" } ], "variable": [ { "disabled": false, "type": "any", "value": "01j9z3k5m7p9r2t4v6x8y0a2b4", "key": "id", "description": "(Required) " } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Not Found", "code": 404, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } } ], "event": [] }, { "id": "9f1ea92b-79a6-f5eb-40c7-180ad9cc4ed4", "name": "Shares", "description": { "content": "Outbound secret shares.", "type": "text/plain" }, "item": [ { "id": "aa9f2767-7792-01bb-0d36-52461c1ba7f5", "name": "Download a chain-of-custody certificate", "request": { "name": "Download a chain-of-custody certificate", "description": { "content": "As `/requests/{id}/certificate`, for a share: the sealed-to recipient fingerprint and the custody events (created, revealed, expired, purged). JSON by default, PDF with `?format=pdf`. Contains no secret material.", "type": "text/plain" }, "url": { "path": [ "shares", ":id", "certificate" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": true, "key": "format", "value": "json", "description": "json (default, signed and verifiable) or pdf (a rendered document)." } ], "variable": [ { "disabled": false, "type": "any", "value": "string", "key": "id", "description": "(Required) The share id." } ] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "GET" }, "response": [ { "id": "895ccc71-38e9-7bf6-13e4-1943239e0195", "name": "The chain-of-custody certificate. A safehanded-custody/v1 JSON document by default, or application/pdf when format=pdf.", "originalRequest": { "url": { "path": [ "shares", ":id", "certificate" ], "host": [ "{{baseUrl}}" ], "query": [ { "key": "format", "value": "json" } ], "variable": [ { "disabled": false, "type": "any", "value": "string", "key": "id", "description": "(Required) The share id." } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "\"\"", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "e2ed8890-4444-6c3e-f45c-1dc0ed7383af", "name": "Missing, unknown, revoked or expired API key.", "originalRequest": { "url": { "path": [ "shares", ":id", "certificate" ], "host": [ "{{baseUrl}}" ], "query": [ { "key": "format", "value": "json" } ], "variable": [ { "disabled": false, "type": "any", "value": "string", "key": "id", "description": "(Required) The share id." } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "c35640de-921b-2a80-db20-470a900f6619", "name": "The key lacks the scope, is scoped to another client, or is used from an address outside its allowlist.", "originalRequest": { "url": { "path": [ "shares", ":id", "certificate" ], "host": [ "{{baseUrl}}" ], "query": [ { "key": "format", "value": "json" } ], "variable": [ { "disabled": false, "type": "any", "value": "string", "key": "id", "description": "(Required) The share id." } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Forbidden", "code": 403, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "336dfb33-0d6f-2eb5-4e96-8688fe217c22", "name": "No such record within this key's scope.", "originalRequest": { "url": { "path": [ "shares", ":id", "certificate" ], "host": [ "{{baseUrl}}" ], "query": [ { "key": "format", "value": "json" } ], "variable": [ { "disabled": false, "type": "any", "value": "string", "key": "id", "description": "(Required) The share id." } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Not Found", "code": 404, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } } ], "event": [] }, { "id": "322f959e-294d-39c1-94a6-380c2dcc29c1", "name": "Events", "description": { "content": "The same events webhooks deliver, for polling.", "type": "text/plain" }, "item": [ { "id": "2ab18d51-4000-34c5-5d60-8ed31b82c8ee", "name": "Read the event feed", "request": { "name": "Read the event feed", "description": { "content": "Events in the order they happened. Pass the previous response's `next_cursor` as `since` to continue; store it between polls. The objects are identical to webhook payloads.", "type": "text/plain" }, "url": { "path": [ "events" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": true, "key": "since", "value": "0", "description": "Cursor from a previous response (an integer sequence number); `0` starts from the oldest retained event." }, { "disabled": true, "key": "types", "value": "request.submitted,request.completed", "description": "Comma-separated event types to include." }, { "disabled": true, "key": "limit", "value": "100" } ], "variable": [] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "GET" }, "response": [ { "id": "f902c4e5-7146-f59b-80b8-d187b8c72c6f", "name": "A page of events.", "originalRequest": { "url": { "path": [ "events" ], "host": [ "{{baseUrl}}" ], "query": [ { "key": "since", "value": "0" }, { "key": "types", "value": "" }, { "key": "limit", "value": "100" } ], "variable": [] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"object\": \"\",\n \"data\": [\n {\n \"id\": \"\",\n \"object\": \"\",\n \"type\": \"\",\n \"occurred_at\": \"\",\n \"organisation_id\": \"\",\n \"data\": {\n \"request\": {\n \"id\": \"\",\n \"object\": \"\",\n \"status\": \"\",\n \"client\": {\n \"id\": \"\",\n \"name\": \"\"\n },\n \"subject\": {\n \"name\": \"\",\n \"email\": \"\",\n \"phone\": \"\"\n },\n \"created_at\": \"\",\n \"ticket\": \"\",\n \"justification\": \"\",\n \"template\": \"\",\n \"requester\": {\n \"membership_id\": \"\",\n \"name\": \"\",\n \"email\": \"\"\n },\n \"recipients\": [\n {\n \"label\": \"\",\n \"membership_id\": {\n \"value\": \"\"\n }\n },\n {\n \"label\": \"\",\n \"membership_id\": {\n \"value\": \"\"\n }\n }\n ],\n \"ttl_minutes\": \"\",\n \"verification_mode\": \"\",\n \"allow_attachments\": \"\",\n \"attachments_count\": \"\",\n \"needs_relink\": \"\",\n \"unrecoverable\": \"\",\n \"reveal_count\": \"\",\n \"purge_reason\": \"\",\n \"revoked_reason\": \"\",\n \"link_expires_at\": \"\",\n \"opened_at\": \"\",\n \"submitted_at\": \"\",\n \"record_expires_at\": \"\",\n \"last_revealed_at\": \"\",\n \"purge_scheduled_at\": \"\",\n \"completed_at\": \"\",\n \"revoked_at\": \"\",\n \"links\": {\n \"self\": \"\",\n \"app\": \"\"\n }\n },\n \"member\": {\n \"membership_id\": \"\",\n \"name\": \"\",\n \"email\": \"\"\n },\n \"justification\": \"\",\n \"details\": \"\",\n \"actor\": {\n \"type\": \"\",\n \"label\": \"\"\n }\n },\n \"client_id\": \"\",\n \"seq\": \"\"\n },\n {\n \"id\": \"\",\n \"object\": \"\",\n \"type\": \"\",\n \"occurred_at\": \"\",\n \"organisation_id\": \"\",\n \"data\": {\n \"request\": {\n \"id\": \"\",\n \"object\": \"\",\n \"status\": \"\",\n \"client\": {\n \"id\": \"\",\n \"name\": \"\"\n },\n \"subject\": {\n \"name\": \"\",\n \"email\": \"\",\n \"phone\": \"\"\n },\n \"created_at\": \"\",\n \"ticket\": \"\",\n \"justification\": \"\",\n \"template\": \"\",\n \"requester\": {\n \"membership_id\": \"\",\n \"name\": \"\",\n \"email\": \"\"\n },\n \"recipients\": [\n {\n \"label\": \"\",\n \"membership_id\": {\n \"value\": \"\"\n }\n },\n {\n \"label\": \"\",\n \"membership_id\": {\n \"value\": \"\"\n }\n }\n ],\n \"ttl_minutes\": \"\",\n \"verification_mode\": \"\",\n \"allow_attachments\": \"\",\n \"attachments_count\": \"\",\n \"needs_relink\": \"\",\n \"unrecoverable\": \"\",\n \"reveal_count\": \"\",\n \"purge_reason\": \"\",\n \"revoked_reason\": \"\",\n \"link_expires_at\": \"\",\n \"opened_at\": \"\",\n \"submitted_at\": \"\",\n \"record_expires_at\": \"\",\n \"last_revealed_at\": \"\",\n \"purge_scheduled_at\": \"\",\n \"completed_at\": \"\",\n \"revoked_at\": \"\",\n \"links\": {\n \"self\": \"\",\n \"app\": \"\"\n }\n },\n \"member\": {\n \"membership_id\": \"\",\n \"name\": \"\",\n \"email\": \"\"\n },\n \"justification\": \"\",\n \"details\": \"\",\n \"actor\": {\n \"type\": \"\",\n \"label\": \"\"\n }\n },\n \"client_id\": \"\",\n \"seq\": \"\"\n }\n ],\n \"has_more\": \"\",\n \"next_cursor\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "076062b1-443b-cbf9-fca0-05fdfc302582", "name": "Missing, unknown, revoked or expired API key.", "originalRequest": { "url": { "path": [ "events" ], "host": [ "{{baseUrl}}" ], "query": [ { "key": "since", "value": "0" }, { "key": "types", "value": "" }, { "key": "limit", "value": "100" } ], "variable": [] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "82c05f65-6528-df8f-9d90-f1a1d77c2700", "name": "The key lacks the scope, is scoped to another client, or is used from an address outside its allowlist.", "originalRequest": { "url": { "path": [ "events" ], "host": [ "{{baseUrl}}" ], "query": [ { "key": "since", "value": "0" }, { "key": "types", "value": "" }, { "key": "limit", "value": "100" } ], "variable": [] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Forbidden", "code": 403, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "dbef62a9-4b12-8188-6cf1-5cf6d05d4b6c", "name": "The body or query is invalid (`errors` lists the fields), or an Idempotency-Key was reused with a different body.", "originalRequest": { "url": { "path": [ "events" ], "host": [ "{{baseUrl}}" ], "query": [ { "key": "since", "value": "0" }, { "key": "types", "value": "" }, { "key": "limit", "value": "100" } ], "variable": [] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Unprocessable Entity (WebDAV) (RFC 4918)", "code": 422, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\",\n \"errors\": {\n \"key_0\": [\n \"\",\n \"\"\n ],\n \"key_1\": [\n \"\",\n \"\"\n ]\n }\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } } ], "event": [] }, { "id": "795aeb13-6e7a-f277-8a46-7e835db3046b", "name": "Tickets", "description": { "content": "Ticket status changes from any automation platform (close-to-purge).", "type": "text/plain" }, "item": [ { "id": "f76ddd4f-b019-41c0-1d90-c9e206c4def5", "name": "Mark a ticket status", "request": { "name": "Mark a ticket status", "description": { "content": "Tell SafeHanded a ticket changed status. Tickets linked through a ticketing integration follow the same path as the vendor's own webhook: where the adapter can read tickets the status is verified against the ticket system before anything is destroyed. Requests and shares that merely quote the reference in their ticket field are matched too; those statuses are unverified and only destroy credentials when the organisation has enabled **Trust unverified webhooks** in Policy. `closed` (and `resolved`, per policy) destroys the credential and completes the request; `open`/`pending` inside the grace window cancels a scheduled destruction.", "type": "text/plain" }, "url": { "path": [ "tickets", ":ref", "status" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "type": "any", "value": "INC-12345", "key": "ref", "description": "(Required) Your ticket reference exactly as entered on the request, or the external ticket id of a linked ticket." } ] }, "header": [ { "disabled": true, "description": "Any unique string (≤ 200 characters) to make this POST safe to retry.", "key": "Idempotency-Key", "value": "{{$guid}}" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"status\": \"closed\"\n}", "options": { "raw": { "language": "json" } } } }, "response": [ { "id": "df75bb75-925a-7859-49e0-0b7da885c507", "name": "Accepted; lists what matched.", "originalRequest": { "url": { "path": [ "tickets", ":ref", "status" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "type": "any", "value": "INC-12345", "key": "ref", "description": "(Required) Your ticket reference exactly as entered on the request, or the external ticket id of a linked ticket." } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "disabled": true, "description": "Any unique string (≤ 200 characters) to make this POST safe to retry.", "key": "Idempotency-Key", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"status\": \"\",\n \"integration_id\": \"\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Accepted", "code": 202, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"accepted\": \"\",\n \"matched\": {\n \"ticket_links\": \"\",\n \"requests\": [\n \"\",\n \"\"\n ],\n \"shares\": [\n \"\",\n \"\"\n ]\n },\n \"ticket_ref\": \"\",\n \"status\": \"\",\n \"verified\": \"\",\n \"note\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "45d7609b-3e6e-949f-3231-f1efb7c28128", "name": "Missing, unknown, revoked or expired API key.", "originalRequest": { "url": { "path": [ "tickets", ":ref", "status" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "type": "any", "value": "INC-12345", "key": "ref", "description": "(Required) Your ticket reference exactly as entered on the request, or the external ticket id of a linked ticket." } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "disabled": true, "description": "Any unique string (≤ 200 characters) to make this POST safe to retry.", "key": "Idempotency-Key", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"status\": \"\",\n \"integration_id\": \"\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "a8a5b444-5ea4-304a-f60b-85a09a6caa3e", "name": "The key lacks the scope, is scoped to another client, or is used from an address outside its allowlist.", "originalRequest": { "url": { "path": [ "tickets", ":ref", "status" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "type": "any", "value": "INC-12345", "key": "ref", "description": "(Required) Your ticket reference exactly as entered on the request, or the external ticket id of a linked ticket." } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "disabled": true, "description": "Any unique string (≤ 200 characters) to make this POST safe to retry.", "key": "Idempotency-Key", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"status\": \"\",\n \"integration_id\": \"\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Forbidden", "code": 403, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "908b28f0-9437-6ddf-34f0-16423d9ae1d3", "name": "The body or query is invalid (`errors` lists the fields), or an Idempotency-Key was reused with a different body.", "originalRequest": { "url": { "path": [ "tickets", ":ref", "status" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "type": "any", "value": "INC-12345", "key": "ref", "description": "(Required) Your ticket reference exactly as entered on the request, or the external ticket id of a linked ticket." } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "disabled": true, "description": "Any unique string (≤ 200 characters) to make this POST safe to retry.", "key": "Idempotency-Key", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"status\": \"\",\n \"integration_id\": \"\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Unprocessable Entity (WebDAV) (RFC 4918)", "code": 422, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\",\n \"errors\": {\n \"key_0\": [\n \"\",\n \"\"\n ],\n \"key_1\": [\n \"\",\n \"\"\n ]\n }\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } } ], "event": [] }, { "id": "21360098-32d2-ef35-b04f-afa33ba77f9a", "name": "Webhook subscriptions", "description": { "content": "Subscribe your URLs to events (REST hooks for connectors). The events SafeHanded then sends are described under Webhooks.", "type": "text/plain" }, "item": [ { "id": "ccf704fb-4835-4bab-5e8c-5968f59a902f", "name": "List webhook subscriptions", "request": { "name": "List webhook subscriptions", "description": {}, "url": { "path": [ "webhooks" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "GET" }, "response": [ { "id": "123b78f4-069a-9138-dde0-384ba8fa4eda", "name": "Subscriptions visible to this key.", "originalRequest": { "url": { "path": [ "webhooks" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"object\": \"\",\n \"data\": [\n {\n \"id\": \"\",\n \"object\": \"\",\n \"url\": \"\",\n \"events\": [\n \"\",\n \"\"\n ],\n \"is_active\": \"\",\n \"description\": \"\",\n \"client_id\": \"\",\n \"created_via\": \"\",\n \"failing_since\": \"\",\n \"last_delivered_at\": \"\",\n \"created_at\": \"\"\n },\n {\n \"id\": \"\",\n \"object\": \"\",\n \"url\": \"\",\n \"events\": [\n \"\",\n \"\"\n ],\n \"is_active\": \"\",\n \"description\": \"\",\n \"client_id\": \"\",\n \"created_via\": \"\",\n \"failing_since\": \"\",\n \"last_delivered_at\": \"\",\n \"created_at\": \"\"\n }\n ]\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "25c81e12-51c2-af3b-218e-b04f04c975ad", "name": "Missing, unknown, revoked or expired API key.", "originalRequest": { "url": { "path": [ "webhooks" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "3531ae1f-c058-2f20-3cd0-7163fed895ed", "name": "The key lacks the scope, is scoped to another client, or is used from an address outside its allowlist.", "originalRequest": { "url": { "path": [ "webhooks" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {} }, "status": "Forbidden", "code": 403, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "1bb9b1c4-f03e-4ca8-d645-36a549739ec6", "name": "Subscribe a URL to events", "request": { "name": "Subscribe a URL to events", "description": { "content": "Creates a webhook owned by this key (client-scoped when the key is). The signing `secret` is returned once. Deliveries carry the Standard Webhooks headers (`webhook-id`, `webhook-timestamp`, `webhook-signature`), so you can verify them with any Standard Webhooks library; the legacy `X-SafeHanded-Signature: t=,v1=.\")>` header is sent alongside during the deprecation window. Retried for 24 hours.", "type": "text/plain" }, "url": { "path": [ "webhooks" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "disabled": true, "description": "Any unique string (≤ 200 characters) to make this POST safe to retry.", "key": "Idempotency-Key", "value": "{{$guid}}" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"url\": \"https://hooks.example.com/safehanded\",\n \"events\": [\n \"request.submitted\",\n \"request.completed\"\n ],\n \"description\": \"Service desk notifications\"\n}", "options": { "raw": { "language": "json" } } } }, "response": [ { "id": "628ff1b4-f541-d9bf-4bdc-05c8b02ad569", "name": "Created; includes the secret.", "originalRequest": { "url": { "path": [ "webhooks" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "disabled": true, "description": "Any unique string (≤ 200 characters) to make this POST safe to retry.", "key": "Idempotency-Key", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"url\": \"\",\n \"events\": [\n \"\"\n ],\n \"description\": \"\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Created", "code": 201, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"events\": [\n \"\",\n \"\"\n ],\n \"id\": \"\",\n \"is_active\": \"\",\n \"object\": \"\",\n \"secret\": \"\",\n \"url\": \"\",\n \"description\": \"\",\n \"client_id\": \"\",\n \"created_via\": \"\",\n \"failing_since\": \"\",\n \"last_delivered_at\": \"\",\n \"created_at\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "fc1f8ecd-8271-4ad7-13aa-54c23cab7da3", "name": "Missing, unknown, revoked or expired API key.", "originalRequest": { "url": { "path": [ "webhooks" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "disabled": true, "description": "Any unique string (≤ 200 characters) to make this POST safe to retry.", "key": "Idempotency-Key", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"url\": \"\",\n \"events\": [\n \"\"\n ],\n \"description\": \"\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "f96514af-05c3-7b67-b2cb-96c9c5c92204", "name": "The key lacks the scope, is scoped to another client, or is used from an address outside its allowlist.", "originalRequest": { "url": { "path": [ "webhooks" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "disabled": true, "description": "Any unique string (≤ 200 characters) to make this POST safe to retry.", "key": "Idempotency-Key", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"url\": \"\",\n \"events\": [\n \"\"\n ],\n \"description\": \"\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Forbidden", "code": 403, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "f8aba624-d3cd-0f75-4149-ef298b7bf3ba", "name": "The body or query is invalid (`errors` lists the fields), or an Idempotency-Key was reused with a different body.", "originalRequest": { "url": { "path": [ "webhooks" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "disabled": true, "description": "Any unique string (≤ 200 characters) to make this POST safe to retry.", "key": "Idempotency-Key", "value": "" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"url\": \"\",\n \"events\": [\n \"\"\n ],\n \"description\": \"\"\n}", "options": { "raw": { "language": "json" } } } }, "status": "Unprocessable Entity (WebDAV) (RFC 4918)", "code": 422, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\",\n \"errors\": {\n \"key_0\": [\n \"\",\n \"\"\n ],\n \"key_1\": [\n \"\",\n \"\"\n ],\n \"key_2\": [\n \"\",\n \"\"\n ],\n \"key_3\": [\n \"\",\n \"\"\n ],\n \"key_4\": [\n \"\",\n \"\"\n ]\n }\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "454c7426-8ef5-56d3-99d8-9b32be986116", "name": "Remove a webhook subscription", "request": { "name": "Remove a webhook subscription", "description": {}, "url": { "path": [ "webhooks", ":id" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "type": "any", "value": "01j9z3k5m7p9r2t4v6x8y0a2b4", "key": "id", "description": "(Required) " } ] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "DELETE" }, "response": [ { "id": "d8ccf785-6d52-6835-c01d-5c0911da2712", "name": "Removed.", "originalRequest": { "url": { "path": [ "webhooks", ":id" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "type": "any", "value": "01j9z3k5m7p9r2t4v6x8y0a2b4", "key": "id", "description": "(Required) " } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " } ], "method": "DELETE", "body": {} }, "status": "No Content", "code": 204, "header": [ { "key": "Content-Type", "value": "text/plain" } ], "body": "", "cookie": [], "_postman_previewlanguage": "text" }, { "id": "d8e31b85-0a85-a381-25df-47b88f4c1e83", "name": "Missing, unknown, revoked or expired API key.", "originalRequest": { "url": { "path": [ "webhooks", ":id" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "type": "any", "value": "01j9z3k5m7p9r2t4v6x8y0a2b4", "key": "id", "description": "(Required) " } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "key": "Accept", "value": "application/json" } ], "method": "DELETE", "body": {} }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "a426f936-8e78-9456-92b3-523c0e9f225a", "name": "The key lacks the scope, is scoped to another client, or is used from an address outside its allowlist.", "originalRequest": { "url": { "path": [ "webhooks", ":id" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "type": "any", "value": "01j9z3k5m7p9r2t4v6x8y0a2b4", "key": "id", "description": "(Required) " } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "key": "Accept", "value": "application/json" } ], "method": "DELETE", "body": {} }, "status": "Forbidden", "code": 403, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "cbd13c77-3674-a4f1-4d8f-238a28e46aa4", "name": "No such record within this key's scope.", "originalRequest": { "url": { "path": [ "webhooks", ":id" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "type": "any", "value": "01j9z3k5m7p9r2t4v6x8y0a2b4", "key": "id", "description": "(Required) " } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " }, { "key": "Accept", "value": "application/json" } ], "method": "DELETE", "body": {} }, "status": "Not Found", "code": 404, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"message\": \"\",\n \"code\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } } ], "event": [] } ], "event": [], "variable": [ { "key": "baseUrl", "value": "https://safehanded.com/api/v1", "type": "string", "description": "Change if you use a different SafeHanded host." }, { "key": "apiKey", "value": "", "type": "string", "description": "Your sh_live_… key from API in SafeHanded." } ], "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{apiKey}}", "type": "string" } ] }, "info": { "_postman_id": "0813e7b8-0392-c711-9f04-702f52ebaa57", "name": "SafeHanded API", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json", "description": { "content": "Authenticate every call with an organisation API key (`sh_live_…`) as a bearer token. Keys are created under **API** in the SafeHanded app; each carries scopes, an optional client scope, an optional IP allowlist and an optional expiry.\n\n**Trying calls from the docs or Postman?** Use a dedicated key with only the scopes you need and a short expiry, and revoke it when you are done. A key typed into the docs page stays in that browser tab and is not saved.\n\n**There is no endpoint that returns a credential.** Envelopes are encrypted in the subject's browser to the recipients' identity keys and can only be opened by a recipient in their browser. The API creates requests, reads their state, ends them, feeds ticket statuses in and manages webhooks.\n\n**Idempotency.** Send an `Idempotency-Key` header (≤ 200 characters) with any POST. The first response is stored for 24 hours and replayed for the same key and body (`Idempotency-Replayed: true`). The same key with a different body is refused with 422 `idempotency_key_reused`; a concurrent duplicate answers 409.\n\n**Rate limit.** 600 requests per minute per key. Exceeding it answers 429 with `Retry-After`.\n\n**Errors** are JSON `{ \"message\", \"code\" }`; validation errors add `errors` keyed by field.\n\n**Recipient commitment.** For API-created requests SafeHanded computes the recipient commitment that normally comes from the technician's browser and returns the complete link, fragment included. The fragment still lets the subject's browser detect later tampering with the stored recipient set, but not a compromised server at creation time. Deliver the full link to the subject, or ask SafeHanded to deliver it (`delivery.method`).\n\nContact Support:\n Name: SafeHanded", "type": "text/plain" } } }