Status means API-key readiness for tenant external integrations, not whether internal
admin console routes exist. A backend route must have an API-key scope before tenants
should build against it with API keys.
Current scope model
API key creation supports these scopes today:API-key access rule
Every API-key route is opt-in. Implemented routes require one of the scopes above. Default dashboard routes reject API-key headers and require a user session. Every live and sandbox API key receives the complete scope list when it is created. Existing active keys are synchronized additively when documented scopes are introduced. There is no public API endpoint to update scopes on an existing key.Recommended internal exclusions
Keep these APIs internal to the Zquence admin console or super-admin operations:- Provider credentials and lifecycle mutation.
- Provider cost and pricing catalog mutation.
- Tenant deletion and recovery mutation.
- Cross-tenant reconciliation recovery actions.
- Platform legal content assignment and platform billing setup.
Integration checklist
- Create separate sandbox and live keys.
- Confirm the key lists the complete current scope catalog.
- Include
x-api-keyandx-api-secret; use environment headers only where endpoint docs require them. - Use pagination for list endpoints.
- Treat
429responses as rate-limit signals and back off. - Verify webhook signatures and deduplicate on
event.id. - Poll sync events if your tenant runs API-only or needs a recovery path for missed webhook delivery.
- Store PII, exports, and webhook payloads according to tenant data-residency policy.