xScaler Customer API
Customer-facing, versioned API for managing tenants and tenant ingestion secrets programmatically.
Authentication
All /v1 endpoints require a developer API key (prefix xsk_) in the
Authorization header:
Authorization: Bearer xsk_live_...
Developer keys are minted from the portal Developer settings (an org owner or
admin calls POST /developer/keys with a JWT). The plaintext key is shown
once at creation and is never retrievable afterwards.
Scopes
Each key carries granular scopes, enforced per endpoint:
| Scope | Grants |
|---|---|
tenants:read | list tenants, list tenant secrets |
tenants:write | create a tenant |
tenants:pause | pause / resume a tenant |
secrets:write | create a tenant ingestion secret |
secrets:delete | delete (hard) a tenant ingestion secret |
One-time secrets
Tenant ingestion secrets (sk_live_ tokens) and developer keys are returned
in plaintext only in the create response. List endpoints return metadata
only. Deletion is a hard delete; the data plane stops authorizing the secret
within a short cache window (~10s).
Authentication
- HTTP: Bearer Auth
- HTTP: Bearer Auth
Org-scoped developer API key.
Security Scheme Type: | http |
|---|---|
HTTP Authorization Scheme: | bearer |
Bearer format: | xsk_live_* |
Portal session JWT (bootstrap routes only).
Security Scheme Type: | http |
|---|---|
HTTP Authorization Scheme: | bearer |
Bearer format: | JWT |