Getting started
Authentication
Every request carries an API key. A key belongs to the workspace it was made in and spends that workspace's balance.
Send the key
Use one of these headers, not both:
Authorization: Bearer sume_live_...cURL
curl https://api.dev.sume.com/v1/jobs?limit=1 \
-H "Authorization: Bearer $SUME_API_KEY"Your keys
Create and revoke keys in Dashboard → API keys. The full key is shown once, when you create it; the list shows only its prefix and last four characters.
- A key made in a team workspace belongs to that workspace, and its jobs spend that workspace's balance.
- A key reads only its own workspace's jobs. A job id from another workspace answers
404. - Requests go to
https://api.dev.sume.com. A signed-in browser session sent there is refused; use a key.
Keep keys on your server
Anyone holding a key can spend your balance. Keep it in a secret store or environment variable, never in client code or a public repository.
Check a key
GET /v1/me returns the key's workspace and metadata without spending anything.
cURL
curl https://api.dev.sume.com/v1/me \
-H "Authorization: Bearer $SUME_API_KEY"200 OK
{
"data": {
"account": {
"workspace_id": "org_2Wk7exampleWorkspace0001",
"owner_user_id": "user_2Uq9exampleOwner000001",
"api_key": {
"id": "key_0b5f2c1e-0000-4000-8000-000000000001",
"name": "server",
"prefix": "sume_live_Ab12Cd34",
"scopes": [
"account:read",
"catalog:read"
]
},
"auth_source": "api_key"
}
}
}Authentication errors
| Status | code | Meaning |
|---|---|---|
| 401 | unauthorized | No key, or the key is wrong or revoked. |
| 401 | session_not_accepted | A dashboard session was sent instead of a key. |
| 403 | insufficient_scope | The key lacks the scope this route needs. |
401 Unauthorized
{
"error": {
"code": "unauthorized",
"message": "Missing or invalid API key.",
"request_id": "req_0ee311b4334e4b118a94c7d1c48577fd",
"category": "auth",
"retryable": false,
"retry_after_seconds": null,
"next_action": "authenticate"
}
}Rotate a key
Create the new key, deploy it, then revoke the old one in the dashboard. A revoked key is refused at once.