Authentication

Authenticate API requests with an API key in the Authorization header. Use the production base URL:

https://api.requidex.com/api/open/v1

Obtain an API key

Ask your Requidex administrator to arrange a key for your integration. Agree which companies or agencies it should access, the required scopes, and its request limits. Keys can also have an expiry date and an IP allowlist.

The full key is returned when it is created. Store it in your application's secret configuration; Requidex stores a hash of the key rather than a recoverable copy. Use a dedicated key for each integration so access and usage can be managed independently.

Keys are environment-specific. Use credentials issued for the environment you are calling.

Send your first request

Set REQUIDEX_API_KEY in your runtime's secret configuration, then call API Key Info:

curl --request GET \
  --url 'https://api.requidex.com/api/open/v1/me' \
  --header "Authorization: Bearer ${REQUIDEX_API_KEY}" \
  --header 'Accept: application/json' \
  --max-time 30

GET /me requires a valid key but no additional resource scope. It returns the key's scopes, company or agency access, configured limits and daily usage. Use it to verify credentials before calling a resource endpoint.

Header	Required	Value
Authorization	Yes	Bearer <API_KEY>
Accept	No	application/json
Content-Type	For requests with a JSON body	application/json

Send the key in the header, never in a URL or query parameter. For an interactive GET request, you can also use the API Explorer. Requests there use the live API and the same access controls and limits.

Company and agency access

A company-scoped key is linked to one or more hiring companies. An agency-scoped key is linked to one or more agencies and can access only permitted records associated with those agencies and their connected companies.

A valid key does not grant access to every endpoint or record. See Authorization and Scopes for how scopes and tenant access work together.

Expiry, revocation and inactivity

Keys stop working when they expire or are revoked. Requidex also automatically revokes keys after 90 days without use; for a key that has never been used, this period starts at creation. The key owner receives an email warning at least seven days before automatic revocation and a notification after revocation.

If an integration is no longer needed, revoke its key. If a key is lost or exposed, arrange a replacement and revoke the old key. Reinstating an inactive key starts a fresh inactivity window.

Authentication failures

HTTP status	Code	Check
401	UNAUTHORIZED	The header is present, the key is correct, and it has not expired or been revoked
403	FORBIDDEN	The key matches the environment, the caller's public IP is allowed, and the requested company or agency access is valid

Do not retry unchanged credentials repeatedly. Resolve the cause first. Other access and validation errors are documented in Responses and Errors.