ReferenceHub & account API

API keys

Create, list and revoke your own API keys (the Hub account page uses these). These take the session_id cookie, so you create keys from a signed-in browser; the key itself is then used with X-API-Key everywhere else.

Method	Path	Summary
POST	`/auth/generate-api-key`	Create an API key
GET	`/auth/api-keys`	List your API keys
POST	`/auth/api-keys/:id/revoke`	Revoke an API key

#Create an API key

POST/auth/generate-api-key

Returns { apiKey } once. It expires after 30 days. Needs the session_id cookie (create keys from Hub → Account → API keys).

Address: https://<your-org>.brambleit.cloud/auth/generate-api-key
Requires: None: public, or protected by a token in the address or body.

Response 201

Field	Type	Description
`apiKey`	string

Example response

JSON

{
  "apiKey": "…"
}

Example request

JavaScript

// From a page served by Bramble (uses the signed-in session)
const res = await fetch('/auth/generate-api-key', {
  method: 'POST',
  credentials: 'include',
});
const data = await res.json();

#List your API keys

GET/auth/api-keys

The keys' records (created, expires, active) — never the key values.

Address: https://<your-org>.brambleit.cloud/auth/api-keys
Requires: None: public, or protected by a token in the address or body.

Response 200

Field	Type	Description
`apiKeys`	array of object
`apiKeys[].id`	integer
`apiKeys[].permissions`	object, or null
`apiKeys[].is_active`	boolean, or null
`apiKeys[].expires_at`	string (date-time), or null
`apiKeys[].created_at`	string (date-time), or null

Example response

JSON

{
  "apiKeys": [
    {
      "id": 42,
      "permissions": {},
      "is_active": true,
      "expires_at": "2026-11-12T09:30:00.000Z",
      "created_at": "2026-11-12T09:30:00.000Z"
    }
  ]
}

Example request

JavaScript

// From a page served by Bramble (uses the signed-in session)
const res = await fetch('/auth/api-keys', {
  method: 'GET',
  credentials: 'include',
});
const data = await res.json();

#Revoke an API key

POST/auth/api-keys/:id/revoke

Address: https://<your-org>.brambleit.cloud/auth/api-keys/:id/revoke
Requires: None: public, or protected by a token in the address or body.

Path parameters

Name	Type	Description
`id`required	integer

Response 200

Field	Type	Description
`message`	string

Example response

JSON

{
  "message": "Saved"
}

Errors

Status	Message
404	API key not found

Example request

JavaScript

// From a page served by Bramble (uses the signed-in session)
const res = await fetch('/auth/api-keys/42/revoke', {
  method: 'POST',
  credentials: 'include',
});
const data = await res.json();

Was this page helpful?