Authentication

Secure your API requests with API keys

The EntityEngine API uses API keys to authenticate requests. You can create and manage API keys from your account settings. Each key can be configured with specific scopes to limit what actions it can perform.

Keep your API keys secure

Your API keys carry many privileges. Do not share them in publicly accessible areas such as GitHub, client-side code, or public repositories.

Creating API Keys

  1. Log in to your EntityEngine account
  2. Navigate to Profile → API Keys
  3. Click Create API Key
  4. Give your key a descriptive name (e.g., "Production", "Development")
  5. Select the scopes your application needs
  6. Click Create Key
  7. Important: Copy your API key immediately. It will only be shown once!

API keys are prefixed with sk_live_ to help you identify them in your code.

Using API Keys

Include your API key in the Authorization header of every request:

Authorization Header
Authorization: Bearer sk_live_your_api_key_here

Example Request

curl -X GET "https://app.entityengine.com/api/v1/entities" \
  -H "Authorization: Bearer sk_live_abc123def456"

JavaScript Example

const response = await fetch('https://app.entityengine.com/api/v1/entities', {
  headers: {
    'Authorization': 'Bearer sk_live_abc123def456',
    'Content-Type': 'application/json',
  },
});

const data = await response.json();

API Scopes

Scopes control what actions an API key can perform. Always use the minimum scopes necessary for your application.

ScopeDescription
entities:readView entities, jurisdictions, products, and requirements
entities:writeCreate and update entities
documents:readView and download documents
documents:writeUpload documents
persons:readView directors, shareholders, and UBOs
persons:writeAdd and update persons
webhooks:readView webhook endpoints
webhooks:writeManage webhook endpoints

Rate Limiting

API requests are rate limited to ensure fair usage. The default limit is 60 requests per minute per API key.

Rate Limit Headers

Every response includes headers to help you track your rate limit status:

HeaderDescription
X-RateLimit-LimitMaximum requests allowed per window
X-RateLimit-RemainingRequests remaining in current window
X-RateLimit-ResetUnix timestamp when the window resets

Handling Rate Limits

When you exceed the rate limit, you'll receive a 429 Too Many Requests response:

{
  "success": false,
  "error": {
    "code": "RATE_LIMIT_EXCEEDED",
    "message": "Rate limit exceeded. Please retry after 45 seconds."
  }
}

Best Practice

Implement exponential backoff when you receive a 429 response. Check theX-RateLimit-Resetheader to know when you can retry.

Authentication Errors

401UNAUTHORIZED

The API key is missing, invalid, or has been revoked.

403FORBIDDEN

The API key doesn't have the required scope for this action.

429RATE_LIMIT_EXCEEDED

Too many requests. Wait and retry after the rate limit window resets.