Authentication

Server-to-server requests to the tenant external API are authenticated with an API key pair. Dashboard and admin-console routes use user sessions instead. A route accepts API keys only when it is documented for API-key access and is backed by an explicit scope. Every request to a tenant-scoped endpoint must include your API key pair:

Header	Value
`x-api-key`	Your publishable key, e.g. `pk_live_...`
`x-api-secret`	Your secret key, e.g. `sk_live_...`
`Content-Type`	`application/json`

The tenant is resolved automatically from the key pair - you never pass tenantId in the URL or body. See Authentication concepts for the full model - key types, rotation, and SSO.

API key scopes

Every live and sandbox API key is assigned the complete documented scope set. See External API surface for the current scope list and the 14 V2 API groups. Routes without an API-key scope return 403 key_forbidden for API-key callers, even if the same route is available in the dashboard with a user session. When new documented scopes are introduced, active keys are synchronized additively so the same credentials continue to work. Key rotation remains available for credential rotation. Zquence does not expose public API-key scope update/delete endpoints today. Sanctions integrations commonly use sanctions.screen, sanctions.read, sanctions.review, and sanctions.export. Webhook inspection and management use webhooks.read and webhooks.write respectively. Each key remains bound to one environment.

Example

curl https://api.zquence.ai/v1/tenants/me \
  -H "x-api-key: pk_live_51H..." \
  -H "x-api-secret: sk_live_51H..."

A successful request returns 200 with the tenant profile:

{
  "tenantId": "tnt_01HX3Z8MQW...",
  "name": "Acme Escrow",
  "status": "active",
  "createdAt": "2026-04-22T09:12:44.000Z"
}

Errors

Status	Code	Cause
`401`	`key_missing`	Both headers must be present.
`401`	`key_invalid`	Key pair doesn’t match an active key.
`401`	`key_revoked`	Key was revoked. Use a new one.
`403`	`key_forbidden`	Key lacks the required scope, or the route is not enabled for API-key access.

Introduction

Tenant

Environments

Customers

Accounts

KYC

Document reviews

Source of funds

Files

Webhooks

Sync

Sanctions

API key scopes

Example

Errors

​API key scopes

​Example

​Errors

API key scopes

Example

Errors