Admin Controls

Requidex administrators manage API credentials and usage from the Integrations area. Available controls depend on the administrator's permissions and the organisation's enabled features.

Configure integration access

Each key has a name, an environment, resource scopes, and either company or agency assignments. Administrators can also configure an IP allowlist, an expiry date, and per-minute and daily request limits.

Before issuing a key, agree which datasets or write actions the integration needs. Grant only those scopes and companies or agencies. Use separate keys for separate integrations so usage and revocation can be managed independently.

The full key is returned when created. Store it securely at that point; subsequent key information does not expose the stored secret. See Authentication for the first-request flow.

Review usage

Key usage records help administrators review request volume, endpoints, response statuses and timing. Compare the observed workload with the key's configured quotas when investigating failed or unexpectedly frequent requests.

Keep a named owner for each integration and review access when its purpose, operator or data requirements change. See Rate Limits for quota behaviour.

Revoke or replace a key

Revoke a key when the integration is retired or its credentials are exposed. For a planned replacement, issue and test the replacement, update the integration's secret configuration, then revoke the old key. Do not keep unused credentials active as a fallback.

Revoked keys cannot authenticate. Where reinstatement is appropriate, the administrator must review the reason for revocation and confirm that the key's access is still required. Reinstatement does not remove expiry or other access restrictions.

Inactive keys are automatically revoked after 90 days without use, with advance notification to the key owner. See Authentication for lifecycle details and Security for incident-response guidance.