Three REST APIs, one zero-knowledge boundary. Build on the Customer API for signed-in users, connect HR, ITSM, SIEM and GRC tools with the Organization API, and give scripts and CI pipelines secrets with the Agent API. Every endpoint has cURL, JavaScript and Python samples and a live Try-it console.
Pick the API that matches who is calling. Every API returns JSON, uses the same error format and carries an x-request-id header you can quote to support.
Get credentials. For your own data, create a personal API key in Passkey-X → Developers → API keys: pick its scopes and expiry, and limit it to your IP addresses. Then check it:Request
Open any endpoint below and choose Try it to send a real request from this page, or Show example response to see what comes back without a key. Requests go straight to the Passkey-X API on this site (/api, /api/org, /api/agent). Requests that change data ask you to confirm first.
Signed in to Passkey-X? The console in Developers uses your session automatically, keeps a list of your recent requests and makes one-hour test keys in one click.
Test credentials
Kept only in this tab’s memory and sent only to the Passkey-X API on this site. Use a short-lived, read-only key for testing (Developers → API keys → Make a test key); reloading the page forgets everything.
Postman and OpenAPI
The Postman collection has every endpoint below, grouped by API, with example bodies, saved example responses and tests that check the status code, the x-request-id header and the error shape. Folder-level Bearer auth reads {{userToken}}, {{orgApiKey}} and {{agentToken}}.
Download the collection and the environment, then in Postman choose Import and drop both files.
Select the Passkey-X (production) environment and paste your key into orgApiKey (it is marked secret).
Send Describe this key first, then run a folder with the Collection Runner to test a whole API.
Run the collection in CI with Newman
npx newman run https://passkey-x.com/api-docs/postman-collection.json \
--env-var "orgApiKey=$PASSKEY_X_API_KEY" \
--folder "Key and audit"
Prefer code generation? The OpenAPI 3.1 file works with openapi-generator, Insomnia, Bruno and Stoplight.
Authentication
API
Send
Where it comes from
Customer API
Authorization: Bearer pxu_…
Personal API key, made in Passkey-X → Developers → API keys. Choose its scopes (vault:read, vault:write, workspaces:read, sync:read, access:read, access:write), when it expires (1–365 days) and, ideally, the IP addresses it may be used from. Shown once; Passkey-X keeps only a hash. Calls run as you under the same access rules as your session. One-click test keys are read-only and expire after one hour.
Customer API (in the app)
Authorization: Bearer <USER_ACCESS_TOKEN>
The short-lived access token of a Passkey-X session, used by the apps and by the console in Developers. If the account uses two-step verification, the session must have completed it, or you get 403 mfa_required. Prefer a personal API key for scripts.
Organization API
Authorization: Bearer pxk_…
Owners and admins create scoped keys in Admin console → Integrations → API keys. Shown once, expire after 1–365 days, revocable any time, optionally limited to IP addresses, and one-hour read-only test keys for consoles and Postman. Every call is attributed to the key in the organization’s Logs.
Agent API
Authorization: Bearer pxa1.<agent id>.<secret>
The one-time agent token from the admin console. Its private key part never leaves the machine; only the agent ID and secret are sent.
Never put Supabase secret or service-role keys, Paddle API keys or Sent keys in browser or integration client code. Store API keys in your tool’s secret store.
Zero-knowledge boundary
Encrypt vault content in the trusted client before sending it. Never submit plaintext passwords, recovery keys, private keys, provider tokens, or raw page/form content. Requests that contain fields such as password or private_key are rejected with 422 plaintext_rejected. The Organization API never returns vault content, names or keys: onboarding, handover, timelines and external-share endpoints describe things by metadata only.
Errors
Every error has the same shape. Use code in your logic, show message to people, and quote request_id (also sent as the x-request-id header) when you contact support. Validation errors add field.
Error response
{ "error": { "code": "validation_failed", "message": "nonce must be …", "request_id": "6f1c…", "field": "nonce" } }
Status
Codes
What to do
400
invalid_jsoninvalid_parameterinvalid_body
The body isn’t valid JSON, or a parameter is out of range. Fix the request.
401
unauthorized
The token or key is missing, expired or revoked. Refresh the session once, or use a new key.
Not allowed. forbidden (Organization API) or insufficient_scope (Customer API, see WWW-Authenticate): the key needs another scope. ip_not_allowed: the key has an IP allowlist without this address. session_required: only a signed-in session can do this (for example create keys). plan_required: the endpoint needs the Business plan. addon_required: the organization needs the add-on (Remote). seat_required: the key's owner needs a Remote seat. signature_required: an administrator must sign this Controller action in the admin console. mfa_required: use a session that completed two-step sign-in.
404
not_found
The resource doesn’t exist or isn’t visible to you.
405
method_not_allowed
The path exists but not for that method. See the Allow header.
409
already_existsconflict
It already exists or was already decided. A repeated create with the same id is safe to treat as done.
410
gone
A removed route (/v1/connectors, /v1/saas).
412
revision_conflict
The item changed since you read it. Fetch it, merge, re-encrypt and retry with the new ETag.
A field is invalid (see field), the body looks like plaintext secrets, or an Idempotency-Key was reused for a different request.
429
rate_limited
Slow down and wait Retry-After seconds, with jitter.
500 / 503
internal_errorservice_unavailableunavailable
Something went wrong on our side, or the service is briefly unavailable. Retry safe requests with backoff.
Rate limits
API
Limit
Headers
Customer API
120 requests per minute per personal API key, counted centrally. With a session token about 120 per minute per account (kept per server instance, so treat it as a guide).
X-RateLimit-Limit, X-RateLimit-Remaining on authenticated responses, Retry-After on 429
Organization API
300 requests per minute per key
X-RateLimit-Limit, X-RateLimit-Remaining on every response, Retry-After (seconds) on 429
Agent API
One request per second per agent
Retry-After on 429
On 429, wait Retry-After seconds and back off with jitter. Never retry unsafe requests blindly after a timeout.
Pagination and sync
GET /v1/vault-items returns { "items": [...], "next_cursor": "…", "has_more": true }. While has_more is true, call again with ?cursor=<next_cursor>. The cursor is opaque: don’t build or change it.
GET /v1/sync/changes returns a string cursor and has_more; store the cursor and send it back on the next call.
Every Organization API list (1.5) answers { "data": [...], "has_more": true, "next_cursor": "…" }: send ?cursor=<next_cursor> back while has_more is true (offset still works). /v1/logs pages newest first and filters by type, from/to, actor, level, status and q; short lists (alerts, access requests, external shares, handovers, weekly reports) also take since, until and q. /v1/audit-events keeps next_after.
Updating safely with ETag and If-Match
Reading or writing an item returns an ETag header such as "3": the item’s current revision. Send it back as If-Match on PATCH and DELETE. If someone changed the item in the meantime you get 412: fetch the latest revision, merge locally, re-encrypt and try again.
Retries and Idempotency-Key. Organization API writes (POST, PUT, PATCH, DELETE) honour an Idempotency-Key header (8–128 characters): the first answer is kept for 24 hours and a repeat returns it again with Idempotent-Replayed: true, so a retried device code isn’t issued twice. On the Customer API the header is reserved: creates are still safe to retry because you choose the item id (a repeat returns 409 already_exists), and updates are protected by If-Match. Organization API writes are safe to repeat: inviting the same email again, approving a decided request or extending a finished onboarding returns the current state or 409 conflict.
Versioning and headers
The path version is /v1. Customer API responses carry API-Version: 2026-10-01; additive changes keep the same version, and breaking changes get a new one with notice. Every response carries x-request-id. Customer API responses also carry Cache-Control: no-store and X-Content-Type-Options: nosniff. Never log request bodies, tokens or ciphertext: log the request ID instead.
The Organization and Agent APIs are now also served from this site at https://passkey-x.com/api/org and https://passkey-x.com/api/agent. The original URLs, such as https://rqblosdixajthfdzqotj.supabase.co/functions/v1/org-api/v1, keep working.
All endpoints at a glance
Every endpoint of the three APIs in one table. Filter by task or scope, then open an endpoint for its parameters, samples and the Try-it console.
Run the Controller and Remote from your own tools, and call the Customer API with personal API keys. Create a Remote invite link when a ticket is opened and end a session from your helpdesk; read every managed computer and queue scans, locks, messages and updates from your RMM or ITSM; follow each action’s result per computer. Personal keys (pxu_…) are scoped, expiring and can be limited to IP addresses. Older keys keep working; add the controller:read, controller:write, remote:read or remote:write scope to a key to use the new endpoints.
Release 1.7: Controller and Remote, personal API keys, IP allowlists and test keysController endpoints for your IT tools: GET /v1/controller (computers, groups, actions), POST /v1/controller/jobs (scan, lock, message, sync or update computers; signed actions stay in the admin console) and GET /v1/controller/jobs/{id} with a result per computer. Remote endpoints for your helpdesk: GET /v1/remote (seats, devices, sessions), invite links (GET, POST and DELETE /v1/remote/invites) and POST /v1/remote/sessions/{id}/end. New scopes: controller:read, controller:write, remote:read and remote:write, and 21 more webhook events for the Controller and Remote. Personal API keys (pxu_…) for the Customer API: scoped (vault, sync, workspaces, access), expiring, revocable, made in Passkey-X → Developers, with GET /v1/me, /v1/api-keys and each key's activity. Personal and organization keys can be limited to IP addresses (403 ip_not_allowed elsewhere) and one-hour read-only test keys are one click away. Every call with a key is logged, and the owner is emailed the first time a key is used from a new IP address. Calls through passkey-x.com/api carry the caller's real, signed IP address.
Organization API 1.6: Signing API, webhook events and webhooks through the APIGET /v1/signature-requests (who still has to sign), POST /v1/documents/{id}/cancel, proof summaries (quantum-safe, passkey, read before signing, offline) on GET /v1/documents/{id}, a new document.signed event, the webhook event catalog (GET /v1/webhooks/events) with exact event subscriptions, and webhooks managed through the API: create, change events, pause, rotate the secret, test, delivery log and replay. New scopes: signatures:write, webhooks:read and webhooks:write.
Organization API 1.5: Logs, company devices and safer automationGET /v1/logs (audit events, sign-ins, API calls, emails and alerts with filters and cursor pages), the company profile, company devices and device codes, setting and stopping policies, blocking and unblocking members, cursor pages on every list, Idempotency-Key on writes and rate-limit headers. Every API call is now recorded in the organization's Logs.
Organization API 1.4: Security centerSign-in risk, incidents and device trust for your SIEM, SOAR or GRC tool. Needs the security:read scope.
Organization API 1.3: Storage, insights and documentsThe storage pool and Runway forecast, the Trust Index, the document register with Seal Chain verification, and the company group report.
Organization API 1.2: Business automationOnboarding, member security, external-sharing approvals, access handover, item timelines and policies.
Customer API
For apps and scripts acting as a signed-in person. Tenant and workspace permissions are enforced by Row Level Security, so a workspace or tenant ID never grants access by itself.
Base URL
https://passkey-x.com/api
Auth
Personal API key (pxu_…) or session token
Rate limit
120 requests per minute per key (or per account for a session)
System
GET/v1/healthCheck the API is upNeeds: None
Liveness check. Needs no token.
Response · 200
{
"status": "ok"
}
cURL
curl -sS -X GET 'https://passkey-x.com/api/v1/health'
curl -sS -X GET 'https://passkey-x.com/api/v1/item-types' \
-H "Authorization: Bearer $PASSKEY_X_PERSONAL_KEY"
Account and API keys
GET/v1/meWho am INew in 1.7Needs: Any key
Who the credential belongs to, the key's name, prefix and scopes (for a personal API key), the requests left this minute, and your_ip: the address the API sees, to put in a key's IP allowlist. With a session token instead of a key, it answers credential "session" and your email, and has no key object. A good first call.
curl -sS -X GET 'https://passkey-x.com/api/v1/api-keys' \
-H "Authorization: Bearer $PASSKEY_X_PERSONAL_KEY"
POST/v1/api-keysCreate a personal API keyNew in 1.7Needs: Session only
Needs a signed-in session (with the second step if you use two-step verification); a key can't create keys. scopes: vault:read, vault:write, workspaces:read, access:read, access:write, sync:read. Up to 10 active keys, 1–365 days. allowed_ips: up to 20 addresses or CIDR ranges (empty = anywhere). test: true makes a read-only key that expires after one hour. The key is in the response once; Passkey-X keeps only a hash.
GET/v1/api-keys/{key_id}/activityA key's recent calls and addressesNew in 1.7Needs: Any key
The key's latest calls (method, endpoint with ids as {id}, status, duration, IP, request id) and every address it was used from, plus 24-hour totals. Kept 90 days.
curl -sS -X GET 'https://passkey-x.com/api/v1/vault-items/c0ffee00-1234-4abc-8def-0123456789ab' \
-H "Authorization: Bearer $PASSKEY_X_PERSONAL_KEY"
POST/v1/vault-itemsCreate an encrypted itemNeeds:vault:write
Encrypt in the client first. Binary fields are \x-prefixed hex. You choose the id, so a retried create returns 409 already_exists instead of a duplicate.
Ask for time-limited access. requested_scope is use, reveal, edit or manage; requested_duration_minutes is 5–10080 (one week); expires_at (RFC 3339) is when the request lapses if nobody decides. You choose the id, so a retry is safe (409 already_exists). The purpose is encrypted with the workspace key.
curl -sS -X GET 'https://passkey-x.com/api/v1/access-grants?workspace_id=3f2a1b0c-9d8e-4f7a-8b6c-5d4e3f2a1b0c' \
-H "Authorization: Bearer $PASSKEY_X_PERSONAL_KEY"
Personal API key scopes (Customer API)
A personal key can hold any of these; /v1/me, /v1/item-types and /v1/api-keys need none. Up to 10 active keys (and 5 test keys) per person; 120 requests per minute per key.
Scope
Allows
vault:read
Read encrypted vault items (list and get)
vault:write
Create, update and delete encrypted vault items
workspaces:read
Your vaults and their members
sync:read
The change feed
access:read
Missions, access requests and grants
access:write
Request access and decide requests
The old /v1/connectors/… and /v1/saas/… routes have been removed and now answer 410 gone. The web app also uses POST /billing (Paddle checkout and customer portal), POST /tenant-sms (Sent notification settings) and POST /account-lifecycle (guarded account deletion) under the same base URL; they are listed in the OpenAPI file. Binary fields are hex text that starts with \x (written \\x inside JSON).
Organization API
A REST API for HR systems, ITSM and ticketing tools, SIEMs, GRC platforms, Zapier and Make: audit events, alerts, members, onboarding, member security, handover, external-sharing approvals, policies, storage, insights, documents, sign-in risk, incidents, device trust, signature requests, webhooks, the Controller and Remote. Vault contents, passwords and encryption keys are never available through it.
Base URL
https://passkey-x.com/api/org
Auth
Organization API key (pxk_…)
Rate limit
300 requests per minute per key
Paths include the /v1 prefix, so GET /v1/me is https://passkey-x.com/api/org/v1/me. API keys are created in the Admin console by organizations on the Business or Enterprise plan; if the organization later leaves Business, Business-only endpoints (onboarding, member security, external shares, handover, company devices, policies, webhooks and the Controller) answer 403 plan_required. Remote endpoints need the Remote add-on (403 addon_required).
Key and audit
GET/v1/meDescribe this keyScope: —
The key's ID and name, organization ID, scopes, whether it is a one-hour test key, API version and how many requests are left this minute. A good first call to test a key. A key with an IP allowlist answers 403 ip_not_allowed from anywhere else.
curl -sS -X GET 'https://passkey-x.com/api/org/v1/items/c0ffee00-1234-4abc-8def-0123456789ab/timeline?limit=100' \
-H "Authorization: Bearer $PASSKEY_X_API_KEY"
Logs
GET/v1/logsRead logsNew in 1.5Scope:logs:read
One list of audit events, member sign-ins, API calls, emails and security alerts, newest first. Filter by type, time range, person, level, status and text; pass next_cursor back as cursor while has_more is true. Ranges up to one year (default: the last 30 days).
curl -sS -X GET 'https://passkey-x.com/api/org/v1/policies' \
-H "Authorization: Bearer $PASSKEY_X_API_KEY"
PUT/v1/policies/{policy_type}Set and enforce a policyNew in 1.5Scope:policies:write
Creates or replaces the organization-wide value of a policy and enforces it (enforced: false keeps it as a draft). The configuration is checked like in the admin console; an invalid one answers 400. Types include session_rules, network_access, company_devices, external_sharing, behavior_guard and trusted_access.
GET/v1/storageStorage reportNew in 1.3Scope:storage:read
The organization's storage pool (plan amount, storage packs, space moved in or out by its company group), usage by vault, department and person, the 90-day trend and the Runway forecast of when it fills up.
curl -sS -X GET 'https://passkey-x.com/api/org/v1/storage' \
-H "Authorization: Bearer $PASSKEY_X_API_KEY"
GET/v1/insightsInsights and Trust IndexNew in 1.3Scope:insights:read
The Passkey-X Trust Index (0–100, grade A–F) with its five parts, shared vaults that depend on one manager, the people whose departure would hurt most, access nobody used for 90 days, and actions ranked by the points they add.
curl -sS -X GET 'https://passkey-x.com/api/org/v1/documents?status=sealed&offset=0&limit=100' \
-H "Authorization: Bearer $PASSKEY_X_API_KEY"
GET/v1/documents/{document_id}One documentNew in 1.3Scope:documents:read
Signers (with public keys and ECDSA P-256 signatures), evidence for outside signers, the document's Seal Chain entries and (1.6) progress and a proof summary for every signature: quantum-safe ML-DSA-65, passkey or fingerprint, read before signing and offline signing.
GET/v1/company-group/reportCompany group reportNew in 1.3Scope:reports:read
For the parent organization of a company group: every organization's plan, seats, members, vaults, storage, onboarding, open alerts, documents and Trust Index, with totals.
curl -sS -X GET 'https://passkey-x.com/api/org/v1/security?days=30' \
-H "Authorization: Bearer $PASSKEY_X_API_KEY"
GET/v1/incidentsIncidentsNew in 1.4Scope:security:read
Security incidents with their playbook (compromised account, lost device, departed employee, phishing click, breach exposure, insider risk) and checklist progress.
Parameter
In
Type
Description
status
query
string
open, in_progress or resolved.
offset
query
integer
Rows to skip (default 0).
limit
query
integer
1–500 (default 100).
cursor
query
string
The next_cursor of the previous page (use instead of offset).
curl -sS -X GET 'https://passkey-x.com/api/org/v1/device-trust' \
-H "Authorization: Bearer $PASSKEY_X_API_KEY"
Company profile and devices
GET/v1/companyCompany profileNew in 1.5Scope:company:read
Company name, logo, colour and sign-in message, the company address (name.passkey-x.com and your own domain) and the access rules: company devices only, office network and working hours, session length and trusted locations.
curl -sS -X GET 'https://passkey-x.com/api/org/v1/company' \
-H "Authorization: Bearer $PASSKEY_X_API_KEY"
GET/v1/company/devicesCompany devices and codesNew in 1.5Scope:company:read
Devices enrolled for members (platform, OS, enrolled and last used) and the device codes issued in the last 200, with their status: open, used, expired or cancelled. Codes themselves are never returned.
curl -sS -X GET 'https://passkey-x.com/api/org/v1/company/devices?include_removed=false' \
-H "Authorization: Bearer $PASSKEY_X_API_KEY"
POST/v1/company/device-codesIssue a device codeNew in 1.5Scope:devices:write
Creates a one-time device code for a member's email and (by default) emails it to them. They enter it once on the company laptop. The code is returned once; only its hash is kept. Send an Idempotency-Key so a retry doesn't issue a second code.
Parameter
In
Type
Description
Idempotency-Key
header
string
8–128 characters; repeats within 24 hours return the first answer.
POST/v1/members/{identity_id}/blockBlock a memberNew in 1.5Scope:members:write
Pauses the member's access to every vault of the organization and signs them out everywhere; roles and vault keys stay, so unblocking restores everything. Owners and admins can't be blocked through the API.
curl -sS -X GET 'https://passkey-x.com/api/org/v1/handovers/preview?from=5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9&to=7a8b9c0d-1e2f-4a3b-8c4d-5e6f7a8b9c0d' \
-H "Authorization: Bearer $PASSKEY_X_API_KEY"
POST/v1/handoversHand over accessNew in 1.2Scope:handover:write
Makes the successor a manager of every vault the leaver owns or manages and queues the passwords the leaver used for rotation. Vault keys are delivered from an administrator's device (Sharing & bundles), so access is end-to-end encrypted.
GET/v1/signature-requestsList signature requestsNew in 1.6Scope:documents:read
Requests sent for signature, newest first, with how many have signed and who is still to sign (and whether they opened it). Filter pending ones to chase signers from your contract or HR system.
Parameter
In
Type
Description
status
query
string
pending, sealed, declined, revoked, lapsed or expired.
curl -sS -X GET 'https://passkey-x.com/api/org/v1/signature-requests?status=pending&limit=100' \
-H "Authorization: Bearer $PASSKEY_X_API_KEY"
POST/v1/documents/{document_id}/cancelCancel a signature requestNew in 1.6Scope:signatures:write
Cancels a pending request: outside signers' links stop working, their copy of the document is deleted, and members see it as cancelled. Recorded in the Seal Chain and the audit log (document.request_cancelled) as the key's owner.
Parameter
In
Type
Description
document_idrequired
path
uuid
The signature request.
Request body
{
"reason": "Replaced by version 2"
}
Response · 200
{
"data": {
"id": "e5f6a7b8-c9d0-4e1f-9a2b-3c4d5e6f7a8b",
"status": "revoked",
"cancelled": true,
"revoked_at": "2026-10-26T09:30:00Z",
"reason": "Replaced by version 2"
}
}
Notable errors: conflict
cURL
curl -sS -X POST 'https://passkey-x.com/api/org/v1/documents/e5f6a7b8-c9d0-4e1f-9a2b-3c4d5e6f7a8b/cancel' \
-H "Authorization: Bearer $PASSKEY_X_API_KEY" \
-H 'Content-Type: application/json' \
--data '{
"reason": "Replaced by version 2"
}'
Webhooks
GET/v1/webhooks/eventsEvent catalogNew in 1.6Scope:webhooks:read
Every event a webhook can subscribe to, with its category. A filter that names one of these events matches that event only; any other filter (such as member.) is a prefix.
Response · 200
{
"data": [
{
"event": "document.signed",
"category": "documents",
"description": "A signer signed a document (with the proof summary)"
},
{
"event": "security_alert.raised",
"category": "security",
"description": "A security alert was raised"
}
]
}
cURL
curl -sS -X GET 'https://passkey-x.com/api/org/v1/webhooks/events' \
-H "Authorization: Bearer $PASSKEY_X_API_KEY"
GET/v1/webhooksList webhooksNew in 1.6Scope:webhooks:read
The organization's webhooks and SIEM destinations (at most 5) with their events, health and last delivery. Secrets are never returned.
curl -sS -X GET 'https://passkey-x.com/api/org/v1/webhooks' \
-H "Authorization: Bearer $PASSKEY_X_API_KEY"
POST/v1/webhooksCreate a webhookNew in 1.6Scope:webhooks:write
Creates an HTTPS webhook (public address only) that starts with the next event. The signing secret (pxwh_…) is returned once; an idempotent replay returns it as null. Leave events out to receive everything.
Parameter
In
Type
Description
Idempotency-Key
header
string
8–128 characters; repeats within 24 hours return the first answer (without the secret).
curl -sS -X GET 'https://passkey-x.com/api/org/v1/webhooks/f1e2d3c4-b5a6-4978-8a9b-0c1d2e3f4a5b/deliveries?limit=50' \
-H "Authorization: Bearer $PASSKEY_X_API_KEY"
POST/v1/webhooks/{webhook_id}/replayReplay eventsNew in 1.6Scope:webhooks:write
Sends events again starting at from_sequence (an audit event of the last 30 days), for example after your receiver lost data. Deliveries stay in order; deduplicate on sequence.
GET/v1/controllerComputers, groups and recent actionsNew in 1.7Scope:controller:read
Every active computer the Controller manages (platform, versions, online, score, baseline and drift, lost mode, Seal Chain state, update state), the groups with their update rings, and the latest 100 actions. Needs the Controller (Business and Enterprise).
curl -sS -X GET 'https://passkey-x.com/api/org/v1/controller' \
-H "Authorization: Bearer $PASSKEY_X_API_KEY"
POST/v1/controller/jobsRun an action on computersNew in 1.7Scope:controller:write
Queues an action for computers, a group or every computer, in the name of the key's owner (recorded as source "api"). Actions that need no signature: lock_screen, message, scan, diagnostics, sync_now, update_app, update_controller, found, app_lock, app_sign_out, app_sync, app_message, and on Controller Enterprise rotate_password and end_elevation. Restart, shutdown, settings, install, uninstall, elevate, wipe and lost mode must be signed by an administrator in the admin console and answer 403 signature_required. Actions expire after 72 hours if a computer never checks in.
Parameter
In
Type
Description
Idempotency-Key
header
string
8–128 characters; a repeat within 24 hours returns the first answer.
GET/v1/controller/jobs/{job_id}One action and its resultsNew in 1.7Scope:controller:read
An action's status and payload with one run per computer: sent, done, failed or skipped, the computer's detail message and whether its Seal Chain entry verified.
curl -sS -X GET 'https://passkey-x.com/api/org/v1/controller/jobs/3e4f5a6b-7c8d-4e9f-8a1b-2c3d4e5f6a7b' \
-H "Authorization: Bearer $PASSKEY_X_API_KEY"
Remote
GET/v1/remoteSeats, devices and sessionsNew in 1.7Scope:remote:read
Remote seats (bought and given), the devices enrolled for unattended or attended access (online when seen in the last 2 minutes) and the latest 200 sessions with who started them, the device, access (view or control), participants and how they ended. Screens, input and chat are end-to-end encrypted and never reach the API.
curl -sS -X GET 'https://passkey-x.com/api/org/v1/remote' \
-H "Authorization: Bearer $PASSKEY_X_API_KEY"
POST/v1/remote/sessions/{session_id}/endEnd a sessionNew in 1.7Scope:remote:write
Ends a live session for everyone (screen sharing, control and any recording stop). Recorded as remote.session_ended with source api.
Parameter
In
Type
Description
session_idrequired
path
uuid
The session.
Response · 200
{
"data": true
}
Notable errors: not_found
cURL
curl -sS -X POST 'https://passkey-x.com/api/org/v1/remote/sessions/5a6b7c8d-9e0f-4a1b-8c3d-4e5f6a7b8c9d/end' \
-H "Authorization: Bearer $PASSKEY_X_API_KEY"
GET/v1/remote/invitesList invite linksNew in 1.7Scope:remote:read
The latest 200 invite links for people outside the organization (open, used, revoked or expired) with the access they asked for and the session they joined.
curl -sS -X GET 'https://passkey-x.com/api/org/v1/remote/invites' \
-H "Authorization: Bearer $PASSKEY_X_API_KEY"
POST/v1/remote/invitesCreate an invite linkNew in 1.7Scope:remote:write
Creates a one-time link that lets someone outside the organization share their screen with the key's owner (who needs a Remote seat), for example from your helpdesk when a ticket is opened. Access is view or control (default control; the person still chooses on their device), valid 1–168 hours (default 24). The secret travels in the link's #fragment, which browsers never send to a server.
Parameter
In
Type
Description
Idempotency-Key
header
string
8–128 characters; a repeat within 24 hours returns the first answer.
Give each integration only what it needs. A key can hold up to 40 scopes, and an organization can have 20 active keys.
Scope
Allows
audit:read
Audit events and item timelines
alerts:read
Security alerts
alerts:write
Acknowledge and resolve alerts
members:read
Members and invitations
members:write
Invite, suspend, reactivate and offboard
reports:read
Security summary, weekly reports, member security
workspaces:read
Shared vaults (no names)
groups:read
Directory groups
access:read
Vault access requests
access:write
Approve and deny vault access requests
onboarding:read
Onboarding progress
onboarding:write
Remind, extend, resume and cancel onboarding
sharing:read
External sharing requests
sharing:write
Approve and decline external links
handover:read
Handovers and previews
handover:write
Hand over a leaver's access
policies:read
Security policies
storage:read
Storage pool, usage and Runway
insights:read
Trust Index and insights
documents:read
Document register, signature requests, proofs and verification
security:read
Sign-in risk, incidents and device trust
logs:read
Logs: audit, sign-ins, API calls, emails and alerts
company:read
Company profile, address, access rules and devices
devices:write
Issue and cancel device codes, remove devices
policies:write
Set, enforce and stop policies
signatures:write
Cancel signature requests
webhooks:read
Webhooks, delivery log and the event catalog
webhooks:write
Create, change, test, replay and delete webhooks
controller:read
Controller computers, groups and actions
controller:write
Run unsigned Controller actions
remote:read
Remote seats, devices, sessions and invite links
remote:write
End sessions, create and revoke invite links
Recipes
HR leaver: preview, hand over, offboard
# 1. What would move? (vaults they manage + passwords used in the last 90 days)
curl -s "https://passkey-x.com/api/org/v1/handovers/preview?from=$LEAVER_ID&to=$SUCCESSOR_ID" \
-H "Authorization: Bearer $PASSKEY_X_API_KEY"
# 2. Hand over: the successor becomes manager and gets the passwords to rotate
curl -s -X POST 'https://passkey-x.com/api/org/v1/handovers' \
-H "Authorization: Bearer $PASSKEY_X_API_KEY" -H 'Content-Type: application/json' \
-d "{\"from_identity_id\":\"$LEAVER_ID\",\"to_identity_id\":\"$SUCCESSOR_ID\",\"note\":\"HR-4411\"}"
# 3. Offboard: access to every shared vault ends immediately
curl -s -X DELETE "https://passkey-x.com/api/org/v1/members/$LEAVER_ID" \
-H "Authorization: Bearer $PASSKEY_X_API_KEY"
Contract system: follow signatures with a webhook
# 1. Subscribe to signatures only (the secret is shown once: store it)
curl -s -X POST 'https://passkey-x.com/api/org/v1/webhooks' \
-H "Authorization: Bearer $PASSKEY_X_API_KEY" -H 'Content-Type: application/json' \
-d '{"name":"Contracts","url":"https://contracts.example.com/passkey-x","events":["document.signed","document.declined","document.sealed","document.request_cancelled"]}'
# 2. Who still has to sign?
curl -s 'https://passkey-x.com/api/org/v1/signature-requests?status=pending' -H "Authorization: Bearer $PASSKEY_X_API_KEY"
# 3. Cancel a request that was superseded
curl -s -X POST "https://passkey-x.com/api/org/v1/documents/$DOCUMENT_ID/cancel" \
-H "Authorization: Bearer $PASSKEY_X_API_KEY" -H 'Content-Type: application/json' -d '{"reason":"Replaced by v2"}'
400invalid_parameter / invalid_body. 401 the key is missing, expired or revoked. 403 the key lacks the required scope, or plan_required. 404 the resource is not in your organization. 409conflict: it was already decided, already exists or a limit was reached. 429 slow down and retry after Retry-After seconds. 503 try again shortly.
No-code tools: in Zapier use “Webhooks by Zapier” (or Make’s HTTP module) with the header Authorization: Bearer <key>, and poll /v1/alerts, /v1/external-shares?status=pending or /v1/audit-events?after=<last sequence>.
Agent API
For scripts, CI pipelines and automation agents that need secrets from vaults shared with them. The server only returns ciphertext; the passkey-x agent command decrypts it on the agent’s own machine.
Base URL
https://passkey-x.com/api/agent
Auth
Agent token (pxa1.<id>.<secret>)
Rate limit
One request per second per agent
Vaults
GET/v1/vaultsRead shared vaultsNeeds: Agent token
Every vault shared with the agent: its sealed vault key and each item's current revision, all ciphertext. The passkey-x agent command decrypts it on the agent's own machine.
curl -sS -X GET 'https://passkey-x.com/api/agent/v1/vaults' \
-H "Authorization: Bearer $PASSKEY_X_AGENT_TOKEN"
401 the token is invalid or was replaced. 403agent_inactive: the agent was stopped, or the organization’s plan or kill switch doesn’t allow agents. Every read is written to the organization’s audit log.
Webhooks
Send audit events to your own endpoint in Admin console → Integrations → Audit streaming (choose “HTTPS webhook”). Subscribe to exact events from the event catalog (GET /v1/webhooks/events), for example document.signed or security_alert.raised, or to a prefix such as member., onboarding. or access_request.: a filter that names a catalog event matches that event only, anything else matches every event that starts with it. Webhooks can also be created and changed through the Organization API (scopes webhooks:read and webhooks:write). Each delivery is a JSON object (type: "audit_events", first_sequence, last_sequence, events: [...]) of up to 200 events, signed with your secret:
Delivery headers
POST /your/endpoint HTTP/1.1
Content-Type: application/json
User-Agent: Passkey-X-Webhooks/1
X-PasskeyX-Webhook: <webhook id>
X-PasskeyX-Timestamp: 1767225600
X-PasskeyX-Signature: v1=<hex HMAC-SHA256 of "<timestamp>.<raw body>" with your full pxwh_ secret>
Verify the signature with a constant-time comparison and reject timestamps older than five minutes. Deliveries are at-least-once and in order (deduplicate on sequence). After a failure the next attempt waits 2, 4, 8, 16 and 32 minutes, then every 60 minutes, and nothing is skipped; a destination that fails 100 times in a row is paused. Recent attempts are listed under each destination (GET /v1/webhooks/{id}/deliveries), and POST /v1/webhooks/{id}/replay sends events of the last 30 days again from a sequence you choose. Splunk HEC, Datadog, Microsoft Sentinel and Elastic are built in.
Test events use "type": "test". Splunk, Datadog, Sentinel, Elastic, Slack and Teams destinations get the event in their own format and authenticate with the destination’s own credential instead of this signature.
Webhook events
The 96 events below can be subscribed to exactly (the same list as GET /v1/webhooks/events). A filter that is not in this list, such as member. or controller., matches every event that starts with it, including audit actions not listed here.
Documents and signing15 events
Event
When
document.signature_requested
A signature request was sent
document.signed
A signer signed a document (with the proof summary)
document.declined
A signer declined to sign
document.sealed
Everyone signed: the document is sealed
document.request_cancelled
A signature request was cancelled (by the sender, or the document was deleted)
document.revoked
A sealed document was revoked
document.expired
A document or signature request expired
document.expiring
A document expires soon
document.recorded
A document signed elsewhere was recorded
document.signed_external
A document was signed with another provider
document.fields_changed
The fields of a pending request changed
document.request_emailed
A signing link was emailed to an outside signer
document.signed_copy_stored
The signed copy was stored in the vault
document.signed_copy_emailed
The signed copy was emailed to the signers
document.signed_copy_resent
The signed copy was sent again
Members and directory12 events
Event
When
member.invited
A person was invited to the organization
member.invitation_cancelled
An invitation was cancelled
member.blocked
A member was blocked
member.unblocked
A member was unblocked
tenant_memberships.role_changed
A member's role changed
tenant_membership.removed
A member was removed
onboarding.step_done
An onboarding step was completed
onboarding.overdue
An onboarding plan is overdue
offboarding.started
Offboarding started
offboarding.completed
Offboarding finished
scim.user_provisioned
The directory (SCIM) added a person
scim.user_deactivated
The directory (SCIM) deactivated a person
Access and sharing10 events
Event
When
access_request.created
Someone asked for access to a vault
access_request.approved
An access request was approved
access_request.denied
An access request was denied
access.handover
Access was handed over from one person to another
workspace.access_removed
Someone's access to a vault was removed
secure_send.created
A Secure Send link was created
secure_send.opened
A Secure Send link was opened
secure_send.revoked
A Secure Send link was revoked
emergency_access.requested
Emergency access was requested
emergency_access.activated
Emergency access was granted
Security11 events
Event
When
security_alert.raised
A security alert was raised
security_incident.opened
A security incident was opened
security_incident.updated
A security incident changed
session.revoked_by_admin
An administrator signed someone out
session.revoked_high_risk
A risky sign-in was signed out
vault.unlock_failed
A vault unlock failed
travel_mode.enabled
Travel mode was turned on
travel_mode.disabled
Travel mode was turned off
behavior_guard.hold_placed
Behavior Guard paused an account
sso.configured
Single sign-on was configured
policy.updated
A security policy changed
Vaults4 events
Event
When
workspace.created
A vault was created
workspace.deleted
A vault was deleted
vault_item.purged
A vault item was deleted for good
attachment.deleted
A file was deleted
Company devices2 events
Event
When
company_device.enrolled
A company device was enrolled
company_device.removed
A company device was removed
API keys and webhooks7 events
Event
When
api_key.created
An API key was created
api_key.revoked
An API key was revoked
audit_webhook.created
A webhook was created
audit_webhook.updated
A webhook's name or events changed
audit_webhook.deleted
A webhook was deleted
audit_webhook.secret_rotated
A webhook's signing secret was replaced
audit_webhook.replayed
A webhook was set to send earlier events again
Controller14 events
Event
When
controller.job_created
A Controller action was created
controller.job_approved
A second administrator approved a Controller action
controller.job_denied
A Controller action was denied
controller.job_finished
Every computer finished a Controller action
controller.job_failed
A computer could not carry out a Controller action
controller.updates_halted
App updates stopped for a group (by an admin or because updates failed)
controller.updates_resumed
App updates resumed for a group
controller.group_changed
A Controller group or its signed baseline changed
controller.keys_changed
The Controller signing or escrow key changed
controller.password_rotated
A computer changed its local admin password
controller.password_checkout_requested
Someone asked to see a local admin password
controller.password_revealed
A local admin password was opened
controller.elevation_requested
A member asked for admin rights on a computer
micro_agent.enrolled
A computer joined the Controller
Remote21 events
Event
When
remote.session_started
A remote support session or screen share started (code, connect or share)
remote.session_accepted
The person on the device allowed viewing or control (or unattended access was used)
remote.session_declined
The person on the device declined
remote.session_ended
A remote session ended (with its length and number of people)
remote.control_given
Someone was given control of a shared screen
remote.participant_joined
Someone joined a remote session or asked to
remote.unattended_on
A device turned on unattended access
remote.invite_created
A remote support invite link was made (in the app or with the API)
A participant's access changed between view and control
remote.participant_removed
Someone was removed from a remote session
remote.invite_revoked
A remote support invite link was revoked (in the app or with the API)
remote.seat_given
A Remote seat was given to a member
remote.seat_removed
A Remote seat was taken back
remote.recording_requested
A technician asked to record a session
remote.recording_allowed
The person on the device allowed recording
remote.recording_declined
The person on the device declined recording
remote.recording_started
Recording started (saved encrypted to the organization's recordings vault)
remote.recording_stopped
Recording stopped
remote.transcript_saved
A session's chat transcript was saved encrypted to the vault
SCIM 2.0 provisioning
Add, update and deactivate members and groups from Okta, Microsoft Entra ID, JumpCloud or any SCIM 2.0 identity provider. Turn it on in Admin console → Identity & SSO, copy the base URL and the token (pxscim_…, shown once), then map each group to a vault so membership follows your directory (guide).
What this server supports (PATCH, filters, up to 200 results).
GET /ResourceTypes · GET /Schemas
The User and Group resource types and their schemas.
GET /Users · POST /Users
Find people (with a filter) or add one. A new person gets an invitation to the organization.
GET · PUT · PATCH · DELETE /Users/{id}
Read, replace, change (active: false deactivates) or remove a person.
GET /Groups · POST /Groups
Find groups or add one.
GET · PUT · PATCH · DELETE /Groups/{id}
Read, replace, add or remove members, or delete a group.
Filters: userName, externalId or emailseq for users; displayName or externalIdeq for groups. PATCH follows RFC 7644 (add, replace and remove, including members[value eq "…"]). Errors use the SCIM error schema with scimType. Deactivating a user ends their access to every shared vault at once; their personal vault stays theirs.
Need help building on Passkey-X?
Questions about the API, a bug or a missing endpoint? Our team replies by email, usually within one business day.
