{ "info": { "name": "Passkey-X API", "_postman_id": "5e0c5f4e-7a1b-4c2d-9e3f-6a5b4c3d2e10", "description": "Customer, Organization and Agent APIs (2026-10-01, release 1.7). 1) Import this collection and the Passkey-X environment. 2) Put a personal API key (pxu_…, Passkey-X → Developers → API keys) in personalApiKey and an organization key (pxk_…) in orgApiKey. Tip: Developers → Postman downloads an environment that already holds a one-hour, read-only test key. 3) Send \"Who am I\" first. Every request has tests for the status code, the x-request-id header and the error shape, and explains 401, 403 ip_not_allowed, 403 insufficient_scope and 429. Keys are secrets: keep them in the environment's secret variables, never in the collection. Docs: https://passkey-x.com/api-docs", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json" }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "if (pm.response.code === 401) pm.test(\"401: the key or token is missing, expired or revoked. Create a new one in Passkey-X → Developers.\", () => pm.expect.fail());", "if (pm.response.code === 403) { let code = \"\"; try { code = pm.response.json().error.code; } catch (e) {}", " if (code === \"ip_not_allowed\") pm.test(\"403 ip_not_allowed: this key has an IP allowlist and this address isn't on it.\", () => pm.expect.fail());", " if (code === \"insufficient_scope\") pm.test(\"403 insufficient_scope: the key needs another scope (see WWW-Authenticate).\", () => pm.expect.fail()); }", "if (pm.response.code === 429) pm.test(\"429: rate limited; wait Retry-After seconds.\", () => pm.expect.fail());" ] } } ], "variable": [ { "key": "customerBaseUrl", "value": "https://passkey-x.com/api" }, { "key": "orgBaseUrl", "value": "https://passkey-x.com/api/org" }, { "key": "agentBaseUrl", "value": "https://passkey-x.com/api/agent" }, { "key": "personalApiKey", "value": "" }, { "key": "orgApiKey", "value": "" }, { "key": "agentToken", "value": "" }, { "key": "auditAfter", "value": "0" }, { "key": "myIp", "value": "" } ], "item": [ { "name": "Customer API", "description": "Create a personal API key in Passkey-X → Developers → API keys (scoped, expiring, optional IP allowlist). In the app's console you can also use your own session. Rate limit: 120 requests per minute per key (or per account for a session).", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{personalApiKey}}", "type": "string" } ] }, "event": [ { "listen": "prerequest", "script": { "type": "text/javascript", "exec": [ "const value = pm.variables.get(\"personalApiKey\");", "if (!value && pm.request.auth && pm.request.auth.type !== \"noauth\") {", " throw new Error(\"Set the personalApiKey variable first (Personal API key (pxu_…) or session token). Create a personal API key in Passkey-X → Developers → API keys (scoped, expiring, optional IP allowlist). In the app's console you can also use your own session.\");", "}" ] } } ], "item": [ { "name": "System", "item": [ { "name": "Check the API is up", "request": { "method": "GET", "description": "Liveness check. Needs no token.\n\nAuth: None. Docs: https://passkey-x.com/api-docs#customer-health", "auth": { "type": "noauth" }, "header": [], "url": { "raw": "{{customerBaseUrl}}/v1/health", "host": [ "{{customerBaseUrl}}" ], "path": [ "v1", "health" ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{customerBaseUrl}}/v1/health" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"status\": \"ok\"\n}" } ] }, { "name": "List item types", "request": { "method": "GET", "description": "The encrypted item types the apps understand.\n\nAuth: Any key. Docs: https://passkey-x.com/api-docs#customer-item-types", "header": [], "url": { "raw": "{{customerBaseUrl}}/v1/item-types", "host": [ "{{customerBaseUrl}}" ], "path": [ "v1", "item-types" ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{customerBaseUrl}}/v1/item-types" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"items\": [\n {\n \"id\": \"login\",\n \"schema_version\": 1\n },\n {\n \"id\": \"secure-note\",\n \"schema_version\": 1\n },\n {\n \"id\": \"api-key\",\n \"schema_version\": 1\n }\n ]\n}" } ] } ] }, { "name": "Account and API keys", "item": [ { "name": "Who am I (new in 1.7)", "request": { "method": "GET", "description": "Who the credential belongs to, the key's name, prefix and scopes (for a personal API key), the requests left this minute, and your_ip: the address the API sees, to put in a key's IP allowlist. With a session token instead of a key, it answers credential \"session\" and your email, and has no key object. A good first call.\n\nAuth: Any key. Docs: https://passkey-x.com/api-docs#customer-me", "header": [], "url": { "raw": "{{customerBaseUrl}}/v1/me", "host": [ "{{customerBaseUrl}}" ], "path": [ "v1", "me" ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });", "if (pm.response.code === 200) pm.collectionVariables.set(\"myIp\", String(pm.response.json().your_ip || \"\"));" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{customerBaseUrl}}/v1/me" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "X-RateLimit-Limit", "value": "120" }, { "key": "X-RateLimit-Remaining", "value": "119" } ], "body": "{\n \"identity_id\": \"5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9\",\n \"credential\": \"personal_api_key\",\n \"your_ip\": \"203.0.113.24\",\n \"key\": {\n \"id\": \"0a1b2c3d-4e5f-4a6b-8c7d-8e9f0a1b2c3d\",\n \"name\": \"Backup script\",\n \"prefix\": \"pxu_3f9a1c2e\",\n \"scopes\": [\n \"vault:read\",\n \"sync:read\"\n ],\n \"test\": false,\n \"expires_at\": \"2027-01-24T09:30:00Z\"\n },\n \"rate_limit\": {\n \"limit\": 120,\n \"remaining\": 119,\n \"window_seconds\": 60\n }\n}" } ] }, { "name": "List your personal API keys (new in 1.7)", "request": { "method": "GET", "description": "Your personal API keys (never the secrets): scopes, IP allowlist, test flag, expiry, and when and from where each was last used.\n\nAuth: Any key. Docs: https://passkey-x.com/api-docs#customer-api-keys", "header": [], "url": { "raw": "{{customerBaseUrl}}/v1/api-keys", "host": [ "{{customerBaseUrl}}" ], "path": [ "v1", "api-keys" ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{customerBaseUrl}}/v1/api-keys" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"keys\": [\n {\n \"id\": \"0a1b2c3d-4e5f-4a6b-8c7d-8e9f0a1b2c3d\",\n \"name\": \"Backup script\",\n \"prefix\": \"pxu_3f9a1c2e\",\n \"scopes\": [\n \"sync:read\",\n \"vault:read\"\n ],\n \"allowed_cidrs\": [\n \"203.0.113.0/24\"\n ],\n \"is_test\": false,\n \"created_at\": \"2026-10-26T09:30:00Z\",\n \"expires_at\": \"2027-01-24T09:30:00Z\",\n \"last_used_at\": \"2026-10-26T09:30:00Z\",\n \"last_used_ip\": \"203.0.113.24\",\n \"revoked_at\": null\n }\n ]\n}" } ] }, { "name": "Create a personal API key (new in 1.7)", "request": { "method": "POST", "description": "Needs a signed-in session (with the second step if you use two-step verification); a key can't create keys. scopes: vault:read, vault:write, workspaces:read, access:read, access:write, sync:read. Up to 10 active keys, 1–365 days. allowed_ips: up to 20 addresses or CIDR ranges (empty = anywhere). test: true makes a read-only key that expires after one hour. The key is in the response once; Passkey-X keeps only a hash.\n\nAuth: Session only. Docs: https://passkey-x.com/api-docs#customer-create-api-key", "header": [ { "key": "Content-Type", "value": "application/json", "description": "JSON body" } ], "url": { "raw": "{{customerBaseUrl}}/v1/api-keys", "host": [ "{{customerBaseUrl}}" ], "path": [ "v1", "api-keys" ] }, "body": { "mode": "raw", "raw": "{\n \"name\": \"Backup script\",\n \"scopes\": [\n \"vault:read\",\n \"sync:read\"\n ],\n \"expires_in_days\": 90,\n \"allowed_ips\": [\n \"203.0.113.0/24\"\n ]\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 201\", () => pm.response.to.have.status(201));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 201", "originalRequest": { "method": "POST", "url": "{{customerBaseUrl}}/v1/api-keys" }, "status": "Created", "code": 201, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"id\": \"0a1b2c3d-4e5f-4a6b-8c7d-8e9f0a1b2c3d\",\n \"key\": \"pxu_3f9a1c2e…(64 hex characters)\",\n \"prefix\": \"pxu_3f9a1c2e\",\n \"scopes\": [\n \"sync:read\",\n \"vault:read\"\n ],\n \"expires_at\": \"2027-01-24T09:30:00Z\",\n \"test\": false,\n \"note\": \"Shown once. Store it in a secret manager; Passkey-X keeps only a hash.\"\n}" } ] }, { "name": "Change a key's IP allowlist (new in 1.7)", "request": { "method": "PATCH", "description": "Replaces the key's IP allowlist (up to 20 addresses or CIDR ranges; [] allows every address). Needs a signed-in session.\n\nAuth: Session only. Docs: https://passkey-x.com/api-docs#customer-update-api-key", "header": [ { "key": "Content-Type", "value": "application/json", "description": "JSON body" } ], "url": { "raw": "{{customerBaseUrl}}/v1/api-keys/:key_id", "host": [ "{{customerBaseUrl}}" ], "path": [ "v1", "api-keys", ":key_id" ], "variable": [ { "key": "key_id", "value": "0a1b2c3d-4e5f-4a6b-8c7d-8e9f0a1b2c3d", "description": "The key." } ] }, "body": { "mode": "raw", "raw": "{\n \"allowed_ips\": [\n \"203.0.113.24\",\n \"198.51.100.0/24\"\n ]\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "PATCH", "url": "{{customerBaseUrl}}/v1/api-keys/:key_id" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"id\": \"0a1b2c3d-4e5f-4a6b-8c7d-8e9f0a1b2c3d\",\n \"allowed_ips\": [\n \"203.0.113.24/32\",\n \"198.51.100.0/24\"\n ]\n}" } ] }, { "name": "Revoke a personal API key (new in 1.7)", "request": { "method": "DELETE", "description": "Revokes the key at once. With a session you can revoke any of your keys; a key can revoke only itself (handy when it may have leaked).\n\nAuth: Any key. Docs: https://passkey-x.com/api-docs#customer-revoke-api-key", "header": [], "url": { "raw": "{{customerBaseUrl}}/v1/api-keys/:key_id", "host": [ "{{customerBaseUrl}}" ], "path": [ "v1", "api-keys", ":key_id" ], "variable": [ { "key": "key_id", "value": "0a1b2c3d-4e5f-4a6b-8c7d-8e9f0a1b2c3d", "description": "The key." } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 204\", () => pm.response.to.have.status(204));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);" ] } } ], "response": [ { "name": "Example 204", "originalRequest": { "method": "DELETE", "url": "{{customerBaseUrl}}/v1/api-keys/:key_id" }, "status": "No Content", "code": 204, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "" } ] }, { "name": "A key's recent calls and addresses (new in 1.7)", "request": { "method": "GET", "description": "The key's latest calls (method, endpoint with ids as {id}, status, duration, IP, request id) and every address it was used from, plus 24-hour totals. Kept 90 days.\n\nAuth: Any key. Docs: https://passkey-x.com/api-docs#customer-api-key-activity", "header": [], "url": { "raw": "{{customerBaseUrl}}/v1/api-keys/:key_id/activity?limit=50", "host": [ "{{customerBaseUrl}}" ], "path": [ "v1", "api-keys", ":key_id", "activity" ], "query": [ { "key": "limit", "value": "50", "description": "1–200 (default 50).", "disabled": false } ], "variable": [ { "key": "key_id", "value": "0a1b2c3d-4e5f-4a6b-8c7d-8e9f0a1b2c3d", "description": "The key." } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{customerBaseUrl}}/v1/api-keys/:key_id/activity?limit=50" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"requests\": [\n {\n \"key_id\": \"0a1b2c3d-4e5f-4a6b-8c7d-8e9f0a1b2c3d\",\n \"method\": \"GET\",\n \"path\": \"/v1/vault-items\",\n \"status\": 200,\n \"duration_ms\": 84,\n \"ip\": \"203.0.113.24\",\n \"request_id\": \"6f1c…\",\n \"created_at\": \"2026-10-26T09:30:00Z\"\n }\n ],\n \"addresses\": [\n {\n \"key_id\": \"0a1b2c3d-4e5f-4a6b-8c7d-8e9f0a1b2c3d\",\n \"ip\": \"203.0.113.24\",\n \"first_seen\": \"2026-10-26T09:30:00Z\",\n \"last_seen\": \"2026-10-26T09:30:00Z\",\n \"requests\": 412\n }\n ],\n \"last_24h\": {\n \"requests\": 412,\n \"errors\": 3,\n \"blocked\": 0\n }\n}" } ] } ] }, { "name": "Workspaces", "item": [ { "name": "List your workspaces", "request": { "method": "GET", "description": "Your active workspaces with your role in each. Names are end-to-end encrypted.\n\nAuth: workspaces:read. Docs: https://passkey-x.com/api-docs#customer-workspaces", "header": [], "url": { "raw": "{{customerBaseUrl}}/v1/workspaces", "host": [ "{{customerBaseUrl}}" ], "path": [ "v1", "workspaces" ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{customerBaseUrl}}/v1/workspaces" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"workspaces\": [\n {\n \"id\": \"3f2a1b0c-9d8e-4f7a-8b6c-5d4e3f2a1b0c\",\n \"tenant_id\": \"8b6a3f1e-2c4d-4e5f-9a0b-1c2d3e4f5a6b\",\n \"kind\": \"shared\",\n \"suite\": \"business\",\n \"status\": \"active\",\n \"current_key_version\": 1,\n \"key_rotation_required\": false,\n \"encrypted_name\": \"\\\\x9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c\",\n \"name_nonce\": \"\\\\xa1a1a1a1a1a1a1a1a1a1a1a1\",\n \"name_aad_hash\": \"\\\\x5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d\",\n \"caller_role\": \"manager\",\n \"created_at\": \"2026-10-26T09:30:00Z\",\n \"updated_at\": \"2026-10-26T09:30:00Z\"\n }\n ]\n}" } ] }, { "name": "List workspace members", "request": { "method": "GET", "description": "Members of a workspace you belong to.\n\nAuth: workspaces:read. Docs: https://passkey-x.com/api-docs#customer-workspace-members", "header": [], "url": { "raw": "{{customerBaseUrl}}/v1/workspaces/:workspace_id/members", "host": [ "{{customerBaseUrl}}" ], "path": [ "v1", "workspaces", ":workspace_id", "members" ], "variable": [ { "key": "workspace_id", "value": "3f2a1b0c-9d8e-4f7a-8b6c-5d4e3f2a1b0c", "description": "The workspace." } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{customerBaseUrl}}/v1/workspaces/:workspace_id/members" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"members\": [\n {\n \"identity_id\": \"5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9\",\n \"tenant_id\": \"8b6a3f1e-2c4d-4e5f-9a0b-1c2d3e4f5a6b\",\n \"workspace_id\": \"3f2a1b0c-9d8e-4f7a-8b6c-5d4e3f2a1b0c\",\n \"role\": \"editor\",\n \"status\": \"active\",\n \"created_at\": \"2026-10-26T09:30:00Z\",\n \"updated_at\": \"2026-10-26T09:30:00Z\"\n }\n ]\n}" } ] } ] }, { "name": "Vault items", "item": [ { "name": "List vault items", "request": { "method": "GET", "description": "The current revision of each live item, newest first. Page with next_cursor while has_more is true.\n\nAuth: vault:read. Docs: https://passkey-x.com/api-docs#customer-vault-items", "header": [], "url": { "raw": "{{customerBaseUrl}}/v1/vault-items?workspace_id=3f2a1b0c-9d8e-4f7a-8b6c-5d4e3f2a1b0c&limit=100", "host": [ "{{customerBaseUrl}}" ], "path": [ "v1", "vault-items" ], "query": [ { "key": "workspace_id", "value": "3f2a1b0c-9d8e-4f7a-8b6c-5d4e3f2a1b0c", "description": "Only this workspace (optional).", "disabled": false }, { "key": "limit", "value": "100", "description": "1–200 (default 100).", "disabled": false }, { "key": "cursor", "value": "", "description": "next_cursor from the previous page.", "disabled": true } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{customerBaseUrl}}/v1/vault-items?workspace_id=3f2a1b0c-9d8e-4f7a-8b6c-5d4e3f2a1b0c&limit=100" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"items\": [\n {\n \"id\": \"c0ffee00-1234-4abc-8def-0123456789ab\",\n \"tenant_id\": \"8b6a3f1e-2c4d-4e5f-9a0b-1c2d3e4f5a6b\",\n \"workspace_id\": \"3f2a1b0c-9d8e-4f7a-8b6c-5d4e3f2a1b0c\",\n \"content_type\": \"login\",\n \"schema_version\": 1,\n \"head_revision\": 3,\n \"key_version\": 1,\n \"nonce\": \"\\\\xa1a1a1a1a1a1a1a1a1a1a1a1\",\n \"ciphertext\": \"\\\\x9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c\",\n \"aad_hash\": \"\\\\x5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d\",\n \"updated_at\": \"2026-10-26T09:30:00Z\"\n }\n ],\n \"next_cursor\": \"eyJ1IjoiMjAyNi0xMC0yNlQwOTozMDowMFoiLCJpIjoiYzBmZmVlMDAifQ\",\n \"has_more\": true\n}" } ] }, { "name": "Get one item", "request": { "method": "GET", "description": "The current revision of one item. The ETag header holds its revision.\n\nAuth: vault:read. Docs: https://passkey-x.com/api-docs#customer-vault-item", "header": [], "url": { "raw": "{{customerBaseUrl}}/v1/vault-items/:item_id", "host": [ "{{customerBaseUrl}}" ], "path": [ "v1", "vault-items", ":item_id" ], "variable": [ { "key": "item_id", "value": "c0ffee00-1234-4abc-8def-0123456789ab", "description": "The item." } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{customerBaseUrl}}/v1/vault-items/:item_id" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "ETag", "value": "\"3\"" } ], "body": "{\n \"id\": \"c0ffee00-1234-4abc-8def-0123456789ab\",\n \"tenant_id\": \"8b6a3f1e-2c4d-4e5f-9a0b-1c2d3e4f5a6b\",\n \"workspace_id\": \"3f2a1b0c-9d8e-4f7a-8b6c-5d4e3f2a1b0c\",\n \"content_type\": \"login\",\n \"schema_version\": 1,\n \"head_revision\": 3,\n \"key_version\": 1,\n \"nonce\": \"\\\\xa1a1a1a1a1a1a1a1a1a1a1a1\",\n \"ciphertext\": \"\\\\x9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c\",\n \"aad_hash\": \"\\\\x5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d\",\n \"updated_at\": \"2026-10-26T09:30:00Z\"\n}" } ] }, { "name": "Create an encrypted item", "request": { "method": "POST", "description": "Encrypt in the client first. Binary fields are \\x-prefixed hex. You choose the id, so a retried create returns 409 already_exists instead of a duplicate.\n\nAuth: vault:write. Docs: https://passkey-x.com/api-docs#customer-create-vault-item", "header": [ { "key": "Content-Type", "value": "application/json", "description": "JSON body" } ], "url": { "raw": "{{customerBaseUrl}}/v1/vault-items", "host": [ "{{customerBaseUrl}}" ], "path": [ "v1", "vault-items" ] }, "body": { "mode": "raw", "raw": "{\n \"id\": \"c0ffee00-1234-4abc-8def-0123456789ab\",\n \"tenant_id\": \"8b6a3f1e-2c4d-4e5f-9a0b-1c2d3e4f5a6b\",\n \"workspace_id\": \"3f2a1b0c-9d8e-4f7a-8b6c-5d4e3f2a1b0c\",\n \"content_type\": \"login\",\n \"schema_version\": 1,\n \"nonce\": \"\\\\xa1a1a1a1a1a1a1a1a1a1a1a1\",\n \"ciphertext\": \"\\\\x9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c\",\n \"aad_hash\": \"\\\\x5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 201\", () => pm.response.to.have.status(201));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 201", "originalRequest": { "method": "POST", "url": "{{customerBaseUrl}}/v1/vault-items" }, "status": "Created", "code": 201, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "ETag", "value": "\"1\"" } ], "body": "{\n \"id\": \"c0ffee00-1234-4abc-8def-0123456789ab\",\n \"head_revision\": 1\n}" } ] }, { "name": "Add a new revision", "request": { "method": "PATCH", "description": "Re-encrypt the item and send the new envelope with the current ETag as If-Match.\n\nAuth: vault:write. Docs: https://passkey-x.com/api-docs#customer-update-vault-item", "header": [ { "key": "If-Match", "value": "\"1\"", "description": "The item's current ETag, for example \"3\". A stale value returns 412." }, { "key": "Content-Type", "value": "application/json", "description": "JSON body" } ], "url": { "raw": "{{customerBaseUrl}}/v1/vault-items/:item_id", "host": [ "{{customerBaseUrl}}" ], "path": [ "v1", "vault-items", ":item_id" ], "variable": [ { "key": "item_id", "value": "c0ffee00-1234-4abc-8def-0123456789ab", "description": "The item." } ] }, "body": { "mode": "raw", "raw": "{\n \"nonce\": \"\\\\xa1a1a1a1a1a1a1a1a1a1a1a1\",\n \"ciphertext\": \"\\\\x9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c\",\n \"aad_hash\": \"\\\\x5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "PATCH", "url": "{{customerBaseUrl}}/v1/vault-items/:item_id" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "ETag", "value": "\"2\"" } ], "body": "{\n \"id\": \"c0ffee00-1234-4abc-8def-0123456789ab\",\n \"head_revision\": 2\n}" } ] }, { "name": "Delete an item", "request": { "method": "DELETE", "description": "Deletes the item (kept as a tombstone so other devices sync the deletion). Send the current ETag as If-Match.\n\nAuth: vault:write. Docs: https://passkey-x.com/api-docs#customer-delete-vault-item", "header": [ { "key": "If-Match", "value": "\"1\"", "description": "The item's current ETag, for example \"3\". A stale value returns 412." } ], "url": { "raw": "{{customerBaseUrl}}/v1/vault-items/:item_id", "host": [ "{{customerBaseUrl}}" ], "path": [ "v1", "vault-items", ":item_id" ], "variable": [ { "key": "item_id", "value": "c0ffee00-1234-4abc-8def-0123456789ab", "description": "The item." } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 204\", () => pm.response.to.have.status(204));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);" ] } } ], "response": [ { "name": "Example 204", "originalRequest": { "method": "DELETE", "url": "{{customerBaseUrl}}/v1/vault-items/:item_id" }, "status": "No Content", "code": 204, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "" } ] } ] }, { "name": "Sync", "item": [ { "name": "Read the change feed", "request": { "method": "GET", "description": "Metadata-only changes since cursor. Store the returned cursor and call again while has_more is true.\n\nAuth: sync:read. Docs: https://passkey-x.com/api-docs#customer-sync-changes", "header": [], "url": { "raw": "{{customerBaseUrl}}/v1/sync/changes?workspace_id=3f2a1b0c-9d8e-4f7a-8b6c-5d4e3f2a1b0c&cursor=0&limit=500", "host": [ "{{customerBaseUrl}}" ], "path": [ "v1", "sync", "changes" ], "query": [ { "key": "workspace_id", "value": "3f2a1b0c-9d8e-4f7a-8b6c-5d4e3f2a1b0c", "description": "The workspace.", "disabled": false }, { "key": "cursor", "value": "0", "description": "The cursor from the previous call (default 0).", "disabled": false }, { "key": "limit", "value": "500", "description": "1–500 (default 500).", "disabled": false } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{customerBaseUrl}}/v1/sync/changes?workspace_id=3f2a1b0c-9d8e-4f7a-8b6c-5d4e3f2a1b0c&cursor=0&limit=500" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"changes\": [\n {\n \"sequence\": 18342,\n \"entity_type\": \"vault_item\",\n \"entity_id\": \"c0ffee00-1234-4abc-8def-0123456789ab\",\n \"operation\": \"update\",\n \"entity_version\": 3,\n \"occurred_at\": \"2026-10-26T09:30:00Z\"\n }\n ],\n \"cursor\": \"18342\",\n \"has_more\": false\n}" } ] } ] }, { "name": "Access requests and grants", "item": [ { "name": "List missions", "request": { "method": "GET", "description": "Active missions in a workspace (encrypted definitions).\n\nAuth: access:read. Docs: https://passkey-x.com/api-docs#customer-missions", "header": [], "url": { "raw": "{{customerBaseUrl}}/v1/missions?workspace_id=3f2a1b0c-9d8e-4f7a-8b6c-5d4e3f2a1b0c", "host": [ "{{customerBaseUrl}}" ], "path": [ "v1", "missions" ], "query": [ { "key": "workspace_id", "value": "3f2a1b0c-9d8e-4f7a-8b6c-5d4e3f2a1b0c", "description": "The workspace.", "disabled": false } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{customerBaseUrl}}/v1/missions?workspace_id=3f2a1b0c-9d8e-4f7a-8b6c-5d4e3f2a1b0c" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"missions\": [\n {\n \"id\": \"9d8c7b6a-5f4e-4d3c-b2a1-0f9e8d7c6b5a\",\n \"tenant_id\": \"8b6a3f1e-2c4d-4e5f-9a0b-1c2d3e4f5a6b\",\n \"workspace_id\": \"3f2a1b0c-9d8e-4f7a-8b6c-5d4e3f2a1b0c\",\n \"status\": \"active\",\n \"definition_nonce\": \"\\\\xa1a1a1a1a1a1a1a1a1a1a1a1\",\n \"encrypted_definition\": \"\\\\x9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c\",\n \"definition_aad_hash\": \"\\\\x5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d\",\n \"mission_items\": [\n {\n \"item_id\": \"c0ffee00-1234-4abc-8def-0123456789ab\",\n \"sort_order\": 0\n }\n ],\n \"created_at\": \"2026-10-26T09:30:00Z\"\n }\n ]\n}" } ] }, { "name": "List access requests", "request": { "method": "GET", "description": "The newest 200 access requests in a workspace.\n\nAuth: access:read. Docs: https://passkey-x.com/api-docs#customer-access-requests", "header": [], "url": { "raw": "{{customerBaseUrl}}/v1/access-requests?workspace_id=3f2a1b0c-9d8e-4f7a-8b6c-5d4e3f2a1b0c", "host": [ "{{customerBaseUrl}}" ], "path": [ "v1", "access-requests" ], "query": [ { "key": "workspace_id", "value": "3f2a1b0c-9d8e-4f7a-8b6c-5d4e3f2a1b0c", "description": "The workspace.", "disabled": false } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{customerBaseUrl}}/v1/access-requests?workspace_id=3f2a1b0c-9d8e-4f7a-8b6c-5d4e3f2a1b0c" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"requests\": [\n {\n \"id\": \"9d8c7b6a-5f4e-4d3c-b2a1-0f9e8d7c6b5a\",\n \"workspace_id\": \"3f2a1b0c-9d8e-4f7a-8b6c-5d4e3f2a1b0c\",\n \"item_id\": \"c0ffee00-1234-4abc-8def-0123456789ab\",\n \"requested_scope\": \"reveal\",\n \"requested_duration_minutes\": 60,\n \"status\": \"pending\",\n \"expires_at\": \"2026-10-26T09:30:00Z\",\n \"created_at\": \"2026-10-26T09:30:00Z\"\n }\n ]\n}" } ] }, { "name": "Request access", "request": { "method": "POST", "description": "Ask for time-limited access. requested_scope is use, reveal, edit or manage; requested_duration_minutes is 5–10080 (one week); expires_at (RFC 3339) is when the request lapses if nobody decides. You choose the id, so a retry is safe (409 already_exists). The purpose is encrypted with the workspace key.\n\nAuth: access:write. Docs: https://passkey-x.com/api-docs#customer-create-access-request", "header": [ { "key": "Content-Type", "value": "application/json", "description": "JSON body" } ], "url": { "raw": "{{customerBaseUrl}}/v1/access-requests", "host": [ "{{customerBaseUrl}}" ], "path": [ "v1", "access-requests" ] }, "body": { "mode": "raw", "raw": "{\n \"id\": \"9d8c7b6a-5f4e-4d3c-b2a1-0f9e8d7c6b5a\",\n \"tenant_id\": \"8b6a3f1e-2c4d-4e5f-9a0b-1c2d3e4f5a6b\",\n \"workspace_id\": \"3f2a1b0c-9d8e-4f7a-8b6c-5d4e3f2a1b0c\",\n \"item_id\": \"c0ffee00-1234-4abc-8def-0123456789ab\",\n \"requested_scope\": \"reveal\",\n \"purpose_nonce\": \"\\\\xa1a1a1a1a1a1a1a1a1a1a1a1\",\n \"encrypted_purpose\": \"\\\\x9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c\",\n \"purpose_aad_hash\": \"\\\\x5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d\",\n \"requested_duration_minutes\": 60,\n \"expires_at\": \"2026-10-26T10:30:00Z\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 201\", () => pm.response.to.have.status(201));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 201", "originalRequest": { "method": "POST", "url": "{{customerBaseUrl}}/v1/access-requests" }, "status": "Created", "code": 201, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"id\": \"9d8c7b6a-5f4e-4d3c-b2a1-0f9e8d7c6b5a\",\n \"status\": \"pending\",\n \"created_at\": \"2026-10-26T09:30:00Z\"\n}" } ] }, { "name": "Approve or deny a request", "request": { "method": "POST", "description": "Managers decide pending requests.\n\nAuth: access:write. Docs: https://passkey-x.com/api-docs#customer-decide-access-request", "header": [ { "key": "Content-Type", "value": "application/json", "description": "JSON body" } ], "url": { "raw": "{{customerBaseUrl}}/v1/access-requests/:request_id/decision", "host": [ "{{customerBaseUrl}}" ], "path": [ "v1", "access-requests", ":request_id", "decision" ], "variable": [ { "key": "request_id", "value": "9d8c7b6a-5f4e-4d3c-b2a1-0f9e8d7c6b5a", "description": "The request." } ] }, "body": { "mode": "raw", "raw": "{\n \"decision\": \"approved\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "POST", "url": "{{customerBaseUrl}}/v1/access-requests/:request_id/decision" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"approval_id\": \"e1f2a3b4-c5d6-4e7f-8a9b-0c1d2e3f4a5b\",\n \"decision\": \"approved\"\n}" } ] }, { "name": "List access grants", "request": { "method": "GET", "description": "The newest 200 time-limited grants in a workspace.\n\nAuth: access:read. Docs: https://passkey-x.com/api-docs#customer-access-grants", "header": [], "url": { "raw": "{{customerBaseUrl}}/v1/access-grants?workspace_id=3f2a1b0c-9d8e-4f7a-8b6c-5d4e3f2a1b0c", "host": [ "{{customerBaseUrl}}" ], "path": [ "v1", "access-grants" ], "query": [ { "key": "workspace_id", "value": "3f2a1b0c-9d8e-4f7a-8b6c-5d4e3f2a1b0c", "description": "The workspace.", "disabled": false } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{customerBaseUrl}}/v1/access-grants?workspace_id=3f2a1b0c-9d8e-4f7a-8b6c-5d4e3f2a1b0c" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"grants\": [\n {\n \"id\": \"f0e1d2c3-b4a5-4968-8776-655443322110\",\n \"workspace_id\": \"3f2a1b0c-9d8e-4f7a-8b6c-5d4e3f2a1b0c\",\n \"item_id\": \"c0ffee00-1234-4abc-8def-0123456789ab\",\n \"subject_identity_id\": \"5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9\",\n \"scope\": \"reveal\",\n \"starts_at\": \"2026-10-26T09:30:00Z\",\n \"expires_at\": \"2026-10-26T10:30:00Z\",\n \"status\": \"active\"\n }\n ]\n}" } ] } ] } ] }, { "name": "Organization API", "description": "Admin console → Integrations → API keys. Use a short-lived, read-only key for testing. Rate limit: 300 requests per minute per key.", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{orgApiKey}}", "type": "string" } ] }, "event": [ { "listen": "prerequest", "script": { "type": "text/javascript", "exec": [ "const value = pm.variables.get(\"orgApiKey\");", "if (!value && pm.request.auth && pm.request.auth.type !== \"noauth\") {", " throw new Error(\"Set the orgApiKey variable first (Organization API key (pxk_…)). Admin console → Integrations → API keys. Use a short-lived, read-only key for testing.\");", "}" ] } } ], "item": [ { "name": "Key and audit", "item": [ { "name": "Describe this key", "request": { "method": "GET", "description": "The key's ID and name, organization ID, scopes, whether it is a one-hour test key, API version and how many requests are left this minute. A good first call to test a key. A key with an IP allowlist answers 403 ip_not_allowed from anywhere else.\n\nScope: —. Docs: https://passkey-x.com/api-docs#org-org-me", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/me", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "me" ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/me" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "X-RateLimit-Limit", "value": "300" }, { "key": "X-RateLimit-Remaining", "value": "299" }, { "key": "X-Org-API-Version", "value": "1.7" } ], "body": "{\n \"key_id\": \"0a1b2c3d-4e5f-4a6b-8c7d-8e9f0a1b2c3d\",\n \"name\": \"SIEM pull\",\n \"organization_id\": \"8b6a3f1e-2c4d-4e5f-9a0b-1c2d3e4f5a6b\",\n \"scopes\": [\n \"audit:read\",\n \"members:read\",\n \"reports:read\"\n ],\n \"test\": false,\n \"api_version\": \"1.7\",\n \"rate_limit\": {\n \"limit\": 300,\n \"remaining\": 299,\n \"window_seconds\": 60\n }\n}" } ] }, { "name": "Read audit events", "request": { "method": "GET", "description": "Tamper-evident audit events in sequence order. Pass next_after back as after (or next_cursor as cursor) while has_more is true.\n\nScope: audit:read. Docs: https://passkey-x.com/api-docs#org-org-audit-events", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/audit-events?after=0&limit=100", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "audit-events" ], "query": [ { "key": "after", "value": "0", "description": "Return events after this sequence (default 0).", "disabled": false }, { "key": "cursor", "value": "", "description": "The next_cursor of the previous page (use instead of offset).", "disabled": true }, { "key": "limit", "value": "100", "description": "1–500 (default 100).", "disabled": false } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });", "if (pm.response.code === 200) pm.collectionVariables.set(\"auditAfter\", String(pm.response.json().next_after));" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/audit-events?after=0&limit=100" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": [\n {\n \"sequence\": 18342,\n \"occurred_at\": \"2026-10-26T09:30:00Z\",\n \"action\": \"member.invited\",\n \"target_type\": \"scim_provisioned_users\",\n \"target_id\": \"5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9\",\n \"actor_identity_id\": null,\n \"metadata\": {\n \"via\": \"api\"\n },\n \"event_hash\": \"9a7f…\"\n }\n ],\n \"next_after\": 18342,\n \"next_cursor\": null,\n \"has_more\": false\n}" } ] }, { "name": "Who used a password (new in 1.2)", "request": { "method": "GET", "description": "Who showed, copied, filled in or changed one vault item, newest first. Metadata only: never the content.\n\nScope: audit:read. Docs: https://passkey-x.com/api-docs#org-org-item-timeline", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/items/:item_id/timeline?limit=100", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "items", ":item_id", "timeline" ], "query": [ { "key": "limit", "value": "100", "description": "1–300 (default 100).", "disabled": false } ], "variable": [ { "key": "item_id", "value": "c0ffee00-1234-4abc-8def-0123456789ab", "description": "The vault item." } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/items/:item_id/timeline?limit=100" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"item_id\": \"c0ffee00-1234-4abc-8def-0123456789ab\",\n \"workspace_id\": \"3f2a1b0c-9d8e-4f7a-8b6c-5d4e3f2a1b0c\",\n \"content_type\": \"login\",\n \"events\": [\n {\n \"sequence\": 18340,\n \"action\": \"item.copied\",\n \"at\": \"2026-10-26T09:30:00Z\",\n \"actor_identity_id\": \"5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9\",\n \"by\": \"Ana Ruiz\"\n }\n ]\n }\n}" } ] } ] }, { "name": "Logs", "item": [ { "name": "Read logs (new in 1.5)", "request": { "method": "GET", "description": "One list of audit events, member sign-ins, API calls, emails and security alerts, newest first. Filter by type, time range, person, level, status and text; pass next_cursor back as cursor while has_more is true. Ranges up to one year (default: the last 30 days).\n\nScope: logs:read. Docs: https://passkey-x.com/api-docs#org-org-logs", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/logs?type=audit,api&from=2026-10-01T00:00:00Z&limit=50", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "logs" ], "query": [ { "key": "type", "value": "audit,api", "description": "Comma-separated: audit, sign_in, api, email, alert (default: all).", "disabled": false }, { "key": "from", "value": "2026-10-01T00:00:00Z", "description": "Start (ISO 8601). Default: 30 days before to.", "disabled": false }, { "key": "to", "value": "", "description": "End (ISO 8601). Default: now.", "disabled": true }, { "key": "actor", "value": "", "description": "Only rows by this member (identity_id).", "disabled": true }, { "key": "level", "value": "", "description": "info, warning or error.", "disabled": true }, { "key": "status", "value": "", "description": "Exact status, e.g. 422 for API calls, failed for emails, open for alerts.", "disabled": true }, { "key": "q", "value": "", "description": "Text search in action, target, summary and person name (up to 100 characters).", "disabled": true }, { "key": "cursor", "value": "", "description": "next_cursor from the previous page.", "disabled": true }, { "key": "limit", "value": "50", "description": "1–200 (default 50).", "disabled": false } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/logs?type=audit,api&from=2026-10-01T00:00:00Z&limit=50" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": [\n {\n \"id\": \"api:8812\",\n \"type\": \"api\",\n \"occurred_at\": \"2026-10-26T09:30:00Z\",\n \"actor_id\": \"5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9\",\n \"actor\": \"Ana Ruiz\",\n \"action\": \"POST /v1/company/device-codes\",\n \"target\": \"HR automation\",\n \"level\": \"info\",\n \"status\": \"201\",\n \"summary\": \"POST /v1/company/device-codes → 201 (48 ms)\",\n \"details\": {\n \"method\": \"POST\",\n \"path\": \"/v1/company/device-codes\",\n \"status\": 201,\n \"duration_ms\": 48,\n \"ip\": \"203.0.113.9\"\n }\n },\n {\n \"id\": \"audit:10442\",\n \"type\": \"audit\",\n \"occurred_at\": \"2026-10-26T09:30:00Z\",\n \"actor_id\": \"5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9\",\n \"actor\": \"Ana Ruiz\",\n \"action\": \"member.blocked\",\n \"target\": \"Sam Lee\",\n \"level\": \"warning\",\n \"status\": \"recorded\",\n \"summary\": \"member.blocked\",\n \"details\": {\n \"reason\": \"Laptop stolen\"\n }\n }\n ],\n \"has_more\": true,\n \"next_cursor\": \"MjAyNi0xMC0yNlQwOTozMDowMC4wMDAwMDBafGF1ZGl0OjEwNDQy\",\n \"from\": \"2026-09-26T09:30:00Z\",\n \"to\": \"2026-10-26T09:30:00Z\"\n}" } ] } ] }, { "name": "Alerts, reports and policies", "item": [ { "name": "List security alerts", "request": { "method": "GET", "description": "Security alerts, newest first.\n\nScope: alerts:read. Docs: https://passkey-x.com/api-docs#org-org-alerts", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/alerts?status=open&limit=50", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "alerts" ], "query": [ { "key": "status", "value": "open", "description": "open, acknowledged or resolved.", "disabled": false }, { "key": "limit", "value": "50", "description": "1–200 (default 50).", "disabled": false }, { "key": "since", "value": "", "description": "Only rows created at or after this time (ISO 8601), for example 2026-10-01.", "disabled": true }, { "key": "until", "value": "", "description": "Only rows created before this time (ISO 8601).", "disabled": true }, { "key": "q", "value": "", "description": "Text search across the row (up to 100 characters).", "disabled": true }, { "key": "cursor", "value": "", "description": "The next_cursor of the previous page (use instead of offset).", "disabled": true } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/alerts?status=open&limit=50" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": [\n {\n \"id\": \"d4e5f6a7-b8c9-4d0e-8f1a-2b3c4d5e6f7a\",\n \"severity\": \"high\",\n \"kind\": \"breach_exposure\",\n \"title\": \"3 passwords found in a new breach\",\n \"status\": \"open\",\n \"created_at\": \"2026-10-26T09:30:00Z\",\n \"acknowledged_at\": null,\n \"actor_identity_id\": \"5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9\"\n }\n ]\n}" } ] }, { "name": "Update an alert", "request": { "method": "PATCH", "description": "Acknowledge, resolve or reopen an alert, for example from your ticket system.\n\nScope: alerts:write. Docs: https://passkey-x.com/api-docs#org-org-update-alert", "header": [ { "key": "Content-Type", "value": "application/json", "description": "JSON body" } ], "url": { "raw": "{{orgBaseUrl}}/v1/alerts/:alert_id", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "alerts", ":alert_id" ], "variable": [ { "key": "alert_id", "value": "d4e5f6a7-b8c9-4d0e-8f1a-2b3c4d5e6f7a", "description": "The alert." } ] }, "body": { "mode": "raw", "raw": "{\n \"status\": \"resolved\",\n \"note\": \"Passwords rotated (INC-4411)\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "PATCH", "url": "{{orgBaseUrl}}/v1/alerts/:alert_id" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"id\": \"d4e5f6a7-b8c9-4d0e-8f1a-2b3c4d5e6f7a\",\n \"status\": \"resolved\"\n }\n}" } ] }, { "name": "Security summary", "request": { "method": "GET", "description": "The organization's current security score, adoption and top risks.\n\nScope: reports:read. Docs: https://passkey-x.com/api-docs#org-org-summary", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/security/summary", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "security", "summary" ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/security/summary" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"generated_at\": \"2026-10-26T09:30:00Z\",\n \"members\": 212,\n \"members_reporting\": 198,\n \"score\": 86,\n \"score_week_ago\": 82,\n \"weak\": 14,\n \"reused\": 9,\n \"breached\": 3,\n \"two_step_pct\": 94,\n \"passkey_pct\": 61,\n \"alerts_open\": 2,\n \"top_risks\": [\n {\n \"key\": \"breached_passwords\",\n \"count\": 3\n }\n ]\n }\n}" } ] }, { "name": "Weekly reports", "request": { "method": "GET", "description": "Stored weekly security reports, newest first.\n\nScope: reports:read. Docs: https://passkey-x.com/api-docs#org-org-weekly", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/reports/weekly?limit=4", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "reports", "weekly" ], "query": [ { "key": "limit", "value": "4", "description": "1–52 (default 4).", "disabled": false }, { "key": "since", "value": "", "description": "Only rows created at or after this time (ISO 8601), for example 2026-10-01.", "disabled": true }, { "key": "until", "value": "", "description": "Only rows created before this time (ISO 8601).", "disabled": true }, { "key": "q", "value": "", "description": "Text search across the row (up to 100 characters).", "disabled": true }, { "key": "cursor", "value": "", "description": "The next_cursor of the previous page (use instead of offset).", "disabled": true } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/reports/weekly?limit=4" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": [\n {\n \"week_start\": \"2026-10-19\",\n \"report\": {\n \"score\": 86,\n \"members\": 212\n },\n \"ai_summary\": null\n }\n ]\n}" } ] }, { "name": "List security policies (new in 1.2)", "request": { "method": "GET", "description": "Every enforced and draft policy with its scope (organization, department or team) — for compliance evidence and drift checks.\n\nScope: policies:read. Docs: https://passkey-x.com/api-docs#org-org-policies", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/policies", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "policies" ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/policies" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": [\n {\n \"id\": \"c3d4e5f6-a7b8-4c9d-8e0f-1a2b3c4d5e6f\",\n \"type\": \"external_sharing\",\n \"scope_type\": \"tenant\",\n \"scope_id\": null,\n \"configuration\": {\n \"mode\": \"approval\",\n \"require_reason\": true,\n \"max_hours\": 72\n },\n \"enforced\": true,\n \"priority\": 100,\n \"version\": 2,\n \"updated_at\": \"2026-10-26T09:30:00Z\"\n }\n ]\n}" } ] }, { "name": "Set and enforce a policy (new in 1.5)", "request": { "method": "PUT", "description": "Creates or replaces the organization-wide value of a policy and enforces it (enforced: false keeps it as a draft). The configuration is checked like in the admin console; an invalid one answers 400. Types include session_rules, network_access, company_devices, external_sharing, behavior_guard and trusted_access.\n\nScope: policies:write. Docs: https://passkey-x.com/api-docs#org-org-policy-set", "header": [ { "key": "Content-Type", "value": "application/json", "description": "JSON body" } ], "url": { "raw": "{{orgBaseUrl}}/v1/policies/:policy_type", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "policies", ":policy_type" ], "variable": [ { "key": "policy_type", "value": "session_rules", "description": "The policy type." } ] }, "body": { "mode": "raw", "raw": "{\n \"configuration\": {\n \"max_session_hours\": 12\n },\n \"enforced\": true\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "PUT", "url": "{{orgBaseUrl}}/v1/policies/:policy_type" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"id\": \"c3d4e5f6-a7b8-4c9d-8e0f-1a2b3c4d5e6f\",\n \"type\": \"session_rules\",\n \"configuration\": {\n \"max_session_hours\": 12\n },\n \"enforced\": true,\n \"version\": 3,\n \"updated_at\": \"2026-10-26T09:30:00Z\"\n }\n}" } ] }, { "name": "Stop enforcing a policy (new in 1.5)", "request": { "method": "DELETE", "description": "Keeps the configuration but stops enforcing it. PUT it again to enforce.\n\nScope: policies:write. Docs: https://passkey-x.com/api-docs#org-org-policy-stop", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/policies/:policy_type", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "policies", ":policy_type" ], "variable": [ { "key": "policy_type", "value": "network_access", "description": "The policy type." } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "DELETE", "url": "{{orgBaseUrl}}/v1/policies/:policy_type" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"id\": \"c3d4e5f6-a7b8-4c9d-8e0f-1a2b3c4d5e6f\",\n \"type\": \"network_access\",\n \"configuration\": {\n \"ip_ranges\": [\n \"203.0.113.0/24\"\n ],\n \"hours_enabled\": false,\n \"days\": [\n 1,\n 2,\n 3,\n 4,\n 5\n ],\n \"start\": \"08:00\",\n \"end\": \"20:00\",\n \"time_zone\": \"UTC\"\n },\n \"enforced\": false,\n \"version\": 4,\n \"updated_at\": \"2026-10-26T09:30:00Z\"\n }\n}" } ] } ] }, { "name": "Storage, insights and documents", "item": [ { "name": "Storage report (new in 1.3)", "request": { "method": "GET", "description": "The organization's storage pool (plan amount, storage packs, space moved in or out by its company group), usage by vault, department and person, the 90-day trend and the Runway forecast of when it fills up.\n\nScope: storage:read. Docs: https://passkey-x.com/api-docs#org-org-storage", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/storage", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "storage" ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/storage" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"allocated\": 21474836480,\n \"used\": 1073741824,\n \"files\": 412,\n \"percent\": 5,\n \"allocation\": {\n \"base\": 21474836480,\n \"packs\": 0,\n \"pack_count\": 0,\n \"moved_in\": 0,\n \"moved_out\": 0,\n \"total\": 21474836480\n },\n \"runway\": {\n \"points\": 31,\n \"growth_bytes_per_day\": 31457280,\n \"days_until_full\": 648,\n \"full_on\": \"2028-08-04\",\n \"r2\": 1,\n \"confidence\": \"high\",\n \"status\": \"healthy\"\n },\n \"by_department\": [\n {\n \"department_id\": null,\n \"name\": \"Company-wide\",\n \"bytes\": 1073741824,\n \"files\": 412\n }\n ]\n }\n}" } ] }, { "name": "Insights and Trust Index (new in 1.3)", "request": { "method": "GET", "description": "The Passkey-X Trust Index (0–100, grade A–F) with its five parts, shared vaults that depend on one manager, the people whose departure would hurt most, access nobody used for 90 days, and actions ranked by the points they add.\n\nScope: insights:read. Docs: https://passkey-x.com/api-docs#org-org-insights", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/insights", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "insights" ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/insights" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"trust_index\": 78,\n \"grade\": \"B\",\n \"components\": {\n \"strong_auth\": {\n \"score\": 92,\n \"weight\": 30,\n \"covered\": 195,\n \"total\": 212\n }\n },\n \"actions\": [\n {\n \"kind\": \"bus_factor\",\n \"count\": 6,\n \"points\": 4.8,\n \"text\": \"6 shared vaults depend on one manager: add a second\"\n }\n ],\n \"departure_impact\": [\n {\n \"identity_id\": \"5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9\",\n \"name\": \"Ana Ruiz\",\n \"score\": 100,\n \"credentials_to_rotate\": 184,\n \"sole_holder_items\": 12,\n \"vaults\": 9\n }\n ]\n }\n}" } ] }, { "name": "Document register (new in 1.3)", "request": { "method": "GET", "description": "Signature requests and recorded signed documents with status, signer progress and expiry. Vault contents are never included.\n\nScope: documents:read. Docs: https://passkey-x.com/api-docs#org-org-documents", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/documents?status=sealed&offset=0&limit=100", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "documents" ], "query": [ { "key": "status", "value": "sealed", "description": "pending, sealed, declined, revoked, lapsed or expired.", "disabled": false }, { "key": "offset", "value": "0", "description": "Rows to skip (default 0).", "disabled": false }, { "key": "limit", "value": "100", "description": "1–500 (default 100).", "disabled": false }, { "key": "cursor", "value": "", "description": "The next_cursor of the previous page (use instead of offset).", "disabled": true } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/documents?status=sealed&offset=0&limit=100" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"esign\": true,\n \"summary\": {\n \"total\": 42,\n \"pending\": 3,\n \"sealed\": 30,\n \"recorded\": 7,\n \"expiring_30\": 2\n },\n \"rows\": [\n {\n \"id\": \"e5f6a7b8-c9d0-4e1f-9a2b-3c4d5e6f7a8b\",\n \"label\": \"Supplier NDA\",\n \"doc_type\": \"nda\",\n \"kind\": \"seal\",\n \"status\": \"sealed\",\n \"expires_on\": \"2027-10-01\",\n \"days_left\": 353,\n \"signers_total\": 2,\n \"signers_signed\": 2,\n \"verify_code\": \"PX-7K2M-QW9D-HT4R-B8NC\"\n }\n ]\n },\n \"next_offset\": 1,\n \"has_more\": false\n}" } ] }, { "name": "One document (new in 1.3)", "request": { "method": "GET", "description": "Signers (with public keys and ECDSA P-256 signatures), evidence for outside signers, the document's Seal Chain entries and (1.6) progress and a proof summary for every signature: quantum-safe ML-DSA-65, passkey or fingerprint, read before signing and offline signing.\n\nScope: documents:read. Docs: https://passkey-x.com/api-docs#org-org-document", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/documents/:document_id", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "documents", ":document_id" ], "variable": [ { "key": "document_id", "value": "e5f6a7b8-c9d0-4e1f-9a2b-3c4d5e6f7a8b", "description": "The document." } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/documents/:document_id" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"id\": \"e5f6a7b8-c9d0-4e1f-9a2b-3c4d5e6f7a8b\",\n \"label\": \"Supplier NDA\",\n \"status\": \"sealed\",\n \"document_sha256\": \"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08\",\n \"signers\": [\n {\n \"kind\": \"external\",\n \"name\": \"Priya Shah\",\n \"email\": \"priya@customer.example\",\n \"status\": \"signed\",\n \"signed_at\": \"2026-10-26T09:30:00Z\"\n }\n ],\n \"ledger\": [\n {\n \"seq\": 12,\n \"event\": \"sealed\",\n \"anchored\": true\n }\n ],\n \"progress\": {\n \"signed\": 1,\n \"declined\": 0,\n \"waiting\": 0,\n \"total\": 1\n },\n \"can_cancel\": false,\n \"proofs\": [\n {\n \"signer_id\": \"b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e\",\n \"position\": 1,\n \"signed_at\": \"2026-10-26T09:30:00Z\",\n \"version\": 2,\n \"quantum_safe\": true,\n \"quantum_safe_algorithm\": \"ML-DSA-65\",\n \"passkey\": \"webauthn\",\n \"passkey_registered\": false,\n \"read_before_signing\": true,\n \"reading\": {\n \"pages\": 3,\n \"total_seconds\": 46,\n \"all_pages\": true\n },\n \"offline\": false,\n \"offline_signed_at\": null,\n \"received_at\": \"2026-10-26T09:30:00Z\"\n }\n ]\n }\n}" } ] }, { "name": "Verify a document (new in 1.3)", "request": { "method": "POST", "description": "Checks a file against its verify code. Send the code and the SHA-256 of the file; a code on its own reveals nothing.\n\nScope: documents:read. Docs: https://passkey-x.com/api-docs#org-org-document-verify", "header": [ { "key": "Content-Type", "value": "application/json", "description": "JSON body" } ], "url": { "raw": "{{orgBaseUrl}}/v1/documents/verify", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "documents", "verify" ] }, "body": { "mode": "raw", "raw": "{\n \"code\": \"PX-7K2M-QW9D-HT4R-B8NC\",\n \"sha256\": \"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "POST", "url": "{{orgBaseUrl}}/v1/documents/verify" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"valid\": true,\n \"status\": \"sealed\",\n \"label\": \"Supplier NDA\",\n \"signers\": [\n {\n \"name\": \"Priya Shah\",\n \"status\": \"signed\"\n }\n ]\n }\n}" } ] }, { "name": "Company group report (new in 1.3)", "request": { "method": "GET", "description": "For the parent organization of a company group: every organization's plan, seats, members, vaults, storage, onboarding, open alerts, documents and Trust Index, with totals.\n\nScope: reports:read. Docs: https://passkey-x.com/api-docs#org-org-company-group", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/company-group/report", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "company-group", "report" ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/company-group/report" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"group\": {\n \"id\": \"a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d\",\n \"name\": \"Acme Holdings\"\n },\n \"totals\": {\n \"organizations\": 3,\n \"seats\": 400,\n \"members\": 352,\n \"allocated\": 858993459200,\n \"used\": 64424509440,\n \"trust_index\": 81\n },\n \"organizations\": [\n {\n \"tenant_id\": \"8b6a3f1e-2c4d-4e5f-9a0b-1c2d3e4f5a6b\",\n \"label\": \"Acme India\",\n \"is_parent\": true,\n \"plan\": \"business\",\n \"seats\": 200,\n \"trust_index\": 84,\n \"grade\": \"B\"\n }\n ]\n }\n}" } ] } ] }, { "name": "Security center", "item": [ { "name": "Security summary (new in 1.4)", "request": { "method": "GET", "description": "Sign-ins scored by the Passkey-X Sign-in Risk model (medium and high), open and resolved incidents, and the device trust mode.\n\nScope: security:read. Docs: https://passkey-x.com/api-docs#org-org-security", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/security?days=30", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "security" ], "query": [ { "key": "days", "value": "30", "description": "Window, 1 to 90 days.", "disabled": false } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/security?days=30" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"days\": 30,\n \"sign_in_risk\": {\n \"sign_ins\": 1840,\n \"medium\": 41,\n \"high\": 3\n },\n \"incidents\": {\n \"open\": 1,\n \"in_progress\": 2,\n \"resolved\": 9\n },\n \"device_trust\": {\n \"mode\": \"block\"\n }\n }\n}" } ] }, { "name": "Incidents (new in 1.4)", "request": { "method": "GET", "description": "Security incidents with their playbook (compromised account, lost device, departed employee, phishing click, breach exposure, insider risk) and checklist progress.\n\nScope: security:read. Docs: https://passkey-x.com/api-docs#org-org-incidents", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/incidents?status=open&offset=0&limit=100", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "incidents" ], "query": [ { "key": "status", "value": "open", "description": "open, in_progress or resolved.", "disabled": false }, { "key": "offset", "value": "0", "description": "Rows to skip (default 0).", "disabled": false }, { "key": "limit", "value": "100", "description": "1–500 (default 100).", "disabled": false }, { "key": "cursor", "value": "", "description": "The next_cursor of the previous page (use instead of offset).", "disabled": true } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/incidents?status=open&offset=0&limit=100" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"rows\": [\n {\n \"id\": \"e5f6a7b8-c9d0-4e1f-9a2b-3c4d5e6f7a8b\",\n \"playbook\": \"lost_device\",\n \"title\": \"Laptop left on a train\",\n \"severity\": \"high\",\n \"status\": \"in_progress\",\n \"automatic\": false,\n \"steps_done\": 2,\n \"steps_total\": 5,\n \"created_at\": \"2026-10-26T09:30:00Z\"\n }\n ]\n },\n \"next_offset\": 1,\n \"has_more\": false\n}" } ] }, { "name": "Device trust (new in 1.4)", "request": { "method": "GET", "description": "Every member device seen in the last 90 days, checked against the organization's device trust policy and the minimum supported app versions.\n\nScope: security:read. Docs: https://passkey-x.com/api-docs#org-org-device-trust", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/device-trust", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "device-trust" ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/device-trust" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"rows\": [\n {\n \"device_id\": \"e5f6a7b8-c9d0-4e1f-9a2b-3c4d5e6f7a8b\",\n \"identity_id\": \"5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9\",\n \"platform\": \"android\",\n \"app_version\": \"1.3.0\",\n \"verdict\": \"block\",\n \"mode\": \"block\",\n \"reasons\": [\n {\n \"id\": \"app_version\",\n \"text\": \"Update Passkey-X to 1.4.0 or later.\"\n }\n ]\n }\n ]\n }\n}" } ] } ] }, { "name": "Company profile and devices", "item": [ { "name": "Company profile (new in 1.5)", "request": { "method": "GET", "description": "Company name, logo, colour and sign-in message, the company address (name.passkey-x.com and your own domain) and the access rules: company devices only, office network and working hours, session length and trusted locations.\n\nScope: company:read. Docs: https://passkey-x.com/api-docs#org-org-company", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/company", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "company" ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/company" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"organization_id\": \"8b6a3f1e-2c4d-4e5f-9a0b-1c2d3e4f5a6b\",\n \"name\": \"Acme Corp\",\n \"logo\": \"data:image/webp;base64,UklGR…\",\n \"accent_color\": \"#1d4ed8\",\n \"sign_in_message\": \"Use your Acme email.\",\n \"address\": \"acme.passkey-x.com\",\n \"custom_domain\": \"vault.acme.com\",\n \"custom_domain_verified\": true,\n \"access_rules\": {\n \"company_devices\": {\n \"configuration\": {\n \"mode\": \"enrolled\",\n \"desktop_only\": false\n },\n \"enforced\": true,\n \"updated_at\": \"2026-10-26T09:30:00Z\"\n },\n \"session_rules\": {\n \"configuration\": {\n \"max_session_hours\": 12\n },\n \"enforced\": true,\n \"updated_at\": \"2026-10-26T09:30:00Z\"\n }\n },\n \"updated_at\": \"2026-10-26T09:30:00Z\"\n }\n}" } ] }, { "name": "Company devices and codes (new in 1.5)", "request": { "method": "GET", "description": "Devices enrolled for members (platform, OS, enrolled and last used) and the device codes issued in the last 200, with their status: open, used, expired or cancelled. Codes themselves are never returned.\n\nScope: company:read. Docs: https://passkey-x.com/api-docs#org-org-company-devices", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/company/devices?include_removed=false", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "company", "devices" ], "query": [ { "key": "include_removed", "value": "false", "description": "true to include removed devices.", "disabled": false } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/company/devices?include_removed=false" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"devices\": [\n {\n \"id\": \"e5f6a7b8-c9d0-4e1f-9a2b-3c4d5e6f7a8b\",\n \"identity_id\": \"5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9\",\n \"name\": \"Ana Ruiz\",\n \"label\": \"ThinkPad 1042\",\n \"platform\": \"desktop\",\n \"os\": \"Windows\",\n \"enrolled_at\": \"2026-10-26T09:30:00Z\",\n \"last_seen_at\": \"2026-10-26T09:30:00Z\",\n \"removed_at\": null\n }\n ],\n \"codes\": [\n {\n \"id\": \"b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e\",\n \"email\": \"ana@example.com\",\n \"label\": \"ThinkPad 1042\",\n \"created_at\": \"2026-10-26T09:30:00Z\",\n \"expires_at\": \"2026-10-26T09:30:00Z\",\n \"used_at\": \"2026-10-26T09:30:00Z\",\n \"cancelled_at\": null,\n \"status\": \"used\"\n }\n ]\n }\n}" } ] }, { "name": "Issue a device code (new in 1.5)", "request": { "method": "POST", "description": "Creates a one-time device code for a member's email and (by default) emails it to them. They enter it once on the company laptop. The code is returned once; only its hash is kept. Send an Idempotency-Key so a retry doesn't issue a second code.\n\nScope: devices:write. Docs: https://passkey-x.com/api-docs#org-org-device-code", "header": [ { "key": "Idempotency-Key", "value": "hr-onboarding-10442", "description": "8–128 characters; repeats within 24 hours return the first answer." }, { "key": "Content-Type", "value": "application/json", "description": "JSON body" } ], "url": { "raw": "{{orgBaseUrl}}/v1/company/device-codes", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "company", "device-codes" ] }, "body": { "mode": "raw", "raw": "{\n \"email\": \"ana@example.com\",\n \"label\": \"ThinkPad 1042\",\n \"hours\": 72,\n \"send_email\": true\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 201\", () => pm.response.to.have.status(201));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 201", "originalRequest": { "method": "POST", "url": "{{orgBaseUrl}}/v1/company/device-codes" }, "status": "Created", "code": 201, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"id\": \"b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e\",\n \"code\": \"PXD-7K2M-QW9D-HT4R\",\n \"email\": \"ana@example.com\",\n \"expires_at\": \"2026-10-26T09:30:00Z\",\n \"emailed\": true\n }\n}" } ] }, { "name": "Remove a company device (new in 1.5)", "request": { "method": "DELETE", "description": "The device stops working for this organization at once (its sessions are signed out of the company rules). Enroll it again with a new code.\n\nScope: devices:write. Docs: https://passkey-x.com/api-docs#org-org-device-remove", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/company/devices/:device_id", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "company", "devices", ":device_id" ], "variable": [ { "key": "device_id", "value": "e5f6a7b8-c9d0-4e1f-9a2b-3c4d5e6f7a8b", "description": "The device." } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "DELETE", "url": "{{orgBaseUrl}}/v1/company/devices/:device_id" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"id\": \"e5f6a7b8-c9d0-4e1f-9a2b-3c4d5e6f7a8b\",\n \"removed_at\": \"2026-10-26T09:30:00Z\"\n }\n}" } ] }, { "name": "Cancel a device code (new in 1.5)", "request": { "method": "DELETE", "description": "An unused code stops working. Used codes can't be cancelled (remove the device instead).\n\nScope: devices:write. Docs: https://passkey-x.com/api-docs#org-org-device-code-cancel", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/company/device-codes/:code_id", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "company", "device-codes", ":code_id" ], "variable": [ { "key": "code_id", "value": "b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e", "description": "The code's id (not the code)." } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "DELETE", "url": "{{orgBaseUrl}}/v1/company/device-codes/:code_id" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"id\": \"b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e\",\n \"cancelled_at\": \"2026-10-26T09:30:00Z\"\n }\n}" } ] } ] }, { "name": "Members and onboarding", "item": [ { "name": "Block a member (new in 1.5)", "request": { "method": "POST", "description": "Pauses the member's access to every vault of the organization and signs them out everywhere; roles and vault keys stay, so unblocking restores everything. Owners and admins can't be blocked through the API.\n\nScope: members:write. Docs: https://passkey-x.com/api-docs#org-org-block", "header": [ { "key": "Content-Type", "value": "application/json", "description": "JSON body" } ], "url": { "raw": "{{orgBaseUrl}}/v1/members/:identity_id/block", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "members", ":identity_id", "block" ], "variable": [ { "key": "identity_id", "value": "5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9", "description": "The member." } ] }, "body": { "mode": "raw", "raw": "{\n \"reason\": \"Laptop reported stolen\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "POST", "url": "{{orgBaseUrl}}/v1/members/:identity_id/block" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"identity_id\": \"5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9\",\n \"blocked\": true,\n \"sessions_signed_out\": 2\n }\n}" } ] }, { "name": "Unblock a member (new in 1.5)", "request": { "method": "POST", "description": "Lifts a block (from the admin console or the API). changed is false when the member wasn't blocked.\n\nScope: members:write. Docs: https://passkey-x.com/api-docs#org-org-unblock", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/members/:identity_id/unblock", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "members", ":identity_id", "unblock" ], "variable": [ { "key": "identity_id", "value": "5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9", "description": "The member." } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "POST", "url": "{{orgBaseUrl}}/v1/members/:identity_id/unblock" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"identity_id\": \"5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9\",\n \"blocked\": false,\n \"changed\": true\n }\n}" } ] }, { "name": "List members", "request": { "method": "GET", "description": "Members with name, email, role, two-step and passkey status and security score.\n\nScope: members:read. Docs: https://passkey-x.com/api-docs#org-org-members", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/members?offset=0&limit=100", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "members" ], "query": [ { "key": "offset", "value": "0", "description": "Rows to skip (default 0).", "disabled": false }, { "key": "limit", "value": "100", "description": "1–500 (default 100).", "disabled": false }, { "key": "cursor", "value": "", "description": "The next_cursor of the previous page (use instead of offset).", "disabled": true } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/members?offset=0&limit=100" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": [\n {\n \"identity_id\": \"5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9\",\n \"role\": \"member\",\n \"status\": \"active\",\n \"display_name\": \"Ana Ruiz\",\n \"job_title\": \"Engineer\",\n \"email\": \"ana@example.com\",\n \"two_step\": true,\n \"passkey\": true,\n \"security_score\": 91,\n \"joined_at\": \"2026-10-26T09:30:00Z\"\n }\n ]\n}" } ] }, { "name": "Invite a member", "request": { "method": "POST", "description": "Invites a person by email (safe to repeat). They join when they sign in with that verified email.\n\nScope: members:write. Docs: https://passkey-x.com/api-docs#org-org-invite", "header": [ { "key": "Content-Type", "value": "application/json", "description": "JSON body" } ], "url": { "raw": "{{orgBaseUrl}}/v1/members", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "members" ] }, "body": { "mode": "raw", "raw": "{\n \"email\": \"ana@example.com\",\n \"display_name\": \"Ana Ruiz\",\n \"job_title\": \"Engineer\",\n \"external_id\": \"HR-10442\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 201\", () => pm.response.to.have.status(201));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 201", "originalRequest": { "method": "POST", "url": "{{orgBaseUrl}}/v1/members" }, "status": "Created", "code": 201, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"id\": \"e2f3a4b5-c6d7-4e8f-9a0b-1c2d3e4f5a6b\",\n \"email\": \"ana@example.com\",\n \"display_name\": \"Ana Ruiz\",\n \"job_title\": \"Engineer\",\n \"identity_id\": null,\n \"status\": \"invited\",\n \"created_at\": \"2026-10-26T09:30:00Z\"\n }\n}" } ] }, { "name": "Suspend a member", "request": { "method": "POST", "description": "Ends their vault access now and flags affected vaults for key rotation.\n\nScope: members:write. Docs: https://passkey-x.com/api-docs#org-org-suspend", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/members/:identity_id/suspend", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "members", ":identity_id", "suspend" ], "variable": [ { "key": "identity_id", "value": "5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9", "description": "The member." } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "POST", "url": "{{orgBaseUrl}}/v1/members/:identity_id/suspend" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"identity_id\": \"5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9\",\n \"role\": \"member\",\n \"status\": \"suspended\"\n }\n}" } ] }, { "name": "Reactivate a member", "request": { "method": "POST", "description": "Restores membership. Vault access must be shared again.\n\nScope: members:write. Docs: https://passkey-x.com/api-docs#org-org-reactivate", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/members/:identity_id/reactivate", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "members", ":identity_id", "reactivate" ], "variable": [ { "key": "identity_id", "value": "5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9", "description": "The member." } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "POST", "url": "{{orgBaseUrl}}/v1/members/:identity_id/reactivate" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"identity_id\": \"5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9\",\n \"role\": \"member\",\n \"status\": \"active\"\n }\n}" } ] }, { "name": "Offboard a member", "request": { "method": "DELETE", "description": "Suspends and deprovisions the member. Owners can't be changed through the API. Pair it with a handover so nothing is lost.\n\nScope: members:write. Docs: https://passkey-x.com/api-docs#org-org-remove", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/members/:identity_id", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "members", ":identity_id" ], "variable": [ { "key": "identity_id", "value": "5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9", "description": "The member." } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "DELETE", "url": "{{orgBaseUrl}}/v1/members/:identity_id" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"identity_id\": \"5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9\",\n \"role\": \"member\",\n \"status\": \"suspended\"\n }\n}" } ] }, { "name": "List open invitations", "request": { "method": "GET", "description": "People invited who haven't joined yet.\n\nScope: members:read. Docs: https://passkey-x.com/api-docs#org-org-invitations", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/invitations?offset=0&limit=100", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "invitations" ], "query": [ { "key": "offset", "value": "0", "description": "Rows to skip (default 0).", "disabled": false }, { "key": "limit", "value": "100", "description": "1–500 (default 100).", "disabled": false }, { "key": "cursor", "value": "", "description": "The next_cursor of the previous page (use instead of offset).", "disabled": true } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/invitations?offset=0&limit=100" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": [\n {\n \"id\": \"e2f3a4b5-c6d7-4e8f-9a0b-1c2d3e4f5a6b\",\n \"email\": \"ana@example.com\",\n \"display_name\": \"Ana Ruiz\",\n \"job_title\": \"Engineer\",\n \"external_id\": \"HR-10442\",\n \"active\": true,\n \"created_at\": \"2026-10-26T09:30:00Z\"\n }\n ]\n}" } ] }, { "name": "Cancel an invitation", "request": { "method": "DELETE", "description": "Cancels an invitation that hasn't been accepted.\n\nScope: members:write. Docs: https://passkey-x.com/api-docs#org-org-cancel-invitation", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/invitations/:invitation_id", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "invitations", ":invitation_id" ], "variable": [ { "key": "invitation_id", "value": "e2f3a4b5-c6d7-4e8f-9a0b-1c2d3e4f5a6b", "description": "The invitation." } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 204\", () => pm.response.to.have.status(204));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);" ] } } ], "response": [ { "name": "Example 204", "originalRequest": { "method": "DELETE", "url": "{{orgBaseUrl}}/v1/invitations/:invitation_id" }, "status": "No Content", "code": 204, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "" } ] }, { "name": "Onboarding progress (new in 1.2)", "request": { "method": "GET", "description": "Every Onboarding Vault plan with its steps and progress. Step titles only — the starting passwords stay end-to-end encrypted.\n\nScope: onboarding:read. Docs: https://passkey-x.com/api-docs#org-org-onboarding", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/onboarding?status=overdue&offset=0&limit=50", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "onboarding" ], "query": [ { "key": "status", "value": "overdue", "description": "invited, active, completed, overdue, paused or cancelled.", "disabled": false }, { "key": "offset", "value": "0", "description": "Rows to skip (default 0).", "disabled": false }, { "key": "limit", "value": "50", "description": "1–200 (default 50).", "disabled": false }, { "key": "cursor", "value": "", "description": "The next_cursor of the previous page (use instead of offset).", "disabled": true } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/onboarding?status=overdue&offset=0&limit=50" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": [\n {\n \"id\": \"a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d\",\n \"workspace_id\": \"3f2a1b0c-9d8e-4f7a-8b6c-5d4e3f2a1b0c\",\n \"label\": \"Ana Ruiz\",\n \"identity_id\": \"5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9\",\n \"status\": \"overdue\",\n \"mode\": \"mandatory\",\n \"due_at\": \"2026-10-26T09:30:00Z\",\n \"created_at\": \"2026-10-26T09:30:00Z\",\n \"started_at\": \"2026-10-26T09:30:00Z\",\n \"completed_at\": null,\n \"last_reminded_at\": null,\n \"reminders\": 0,\n \"steps_total\": 4,\n \"steps_done\": 2,\n \"steps\": [\n {\n \"id\": \"0b1c2d3e-4f5a-4b6c-8d7e-9f0a1b2c3d4e\",\n \"title\": \"Microsoft 365\",\n \"kind\": \"credential\",\n \"change_required\": true,\n \"done_at\": \"2026-10-26T09:30:00Z\",\n \"rotated_at\": \"2026-10-26T09:30:00Z\"\n }\n ],\n \"waiting_for_key\": false\n }\n ]\n}" } ] }, { "name": "Send a reminder (new in 1.2)", "request": { "method": "POST", "description": "Emails the new hire about the steps left. At most one reminder per hour; they must have joined.\n\nScope: onboarding:write. Docs: https://passkey-x.com/api-docs#org-org-onboarding-remind", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/onboarding/:plan_id/remind", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "onboarding", ":plan_id", "remind" ], "variable": [ { "key": "plan_id", "value": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "description": "The onboarding plan." } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "POST", "url": "{{orgBaseUrl}}/v1/onboarding/:plan_id/remind" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"id\": \"a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d\",\n \"status\": \"active\",\n \"due_at\": \"2026-10-26T09:30:00Z\",\n \"last_reminded_at\": \"2026-10-26T09:30:00Z\",\n \"reminders\": 1\n }\n}" } ] }, { "name": "Extend the deadline (new in 1.2)", "request": { "method": "POST", "description": "Moves the deadline later by days (1–90, default 7) and lifts an overdue pause.\n\nScope: onboarding:write. Docs: https://passkey-x.com/api-docs#org-org-onboarding-extend", "header": [ { "key": "Content-Type", "value": "application/json", "description": "JSON body" } ], "url": { "raw": "{{orgBaseUrl}}/v1/onboarding/:plan_id/extend", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "onboarding", ":plan_id", "extend" ], "variable": [ { "key": "plan_id", "value": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "description": "The onboarding plan." } ] }, "body": { "mode": "raw", "raw": "{\n \"days\": 7\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "POST", "url": "{{orgBaseUrl}}/v1/onboarding/:plan_id/extend" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"id\": \"a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d\",\n \"status\": \"active\",\n \"due_at\": \"2026-11-02T09:30:00Z\",\n \"last_reminded_at\": null,\n \"reminders\": 0\n }\n}" } ] }, { "name": "Resume paused onboarding (new in 1.2)", "request": { "method": "POST", "description": "Restores vault access paused for an overdue onboarding and gives days more (default 7).\n\nScope: onboarding:write. Docs: https://passkey-x.com/api-docs#org-org-onboarding-resume", "header": [ { "key": "Content-Type", "value": "application/json", "description": "JSON body" } ], "url": { "raw": "{{orgBaseUrl}}/v1/onboarding/:plan_id/resume", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "onboarding", ":plan_id", "resume" ], "variable": [ { "key": "plan_id", "value": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "description": "The onboarding plan." } ] }, "body": { "mode": "raw", "raw": "{\n \"days\": 3\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "POST", "url": "{{orgBaseUrl}}/v1/onboarding/:plan_id/resume" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"id\": \"a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d\",\n \"status\": \"active\",\n \"due_at\": \"2026-10-29T09:30:00Z\",\n \"last_reminded_at\": null,\n \"reminders\": 0\n }\n}" } ] }, { "name": "Cancel onboarding (new in 1.2)", "request": { "method": "POST", "description": "Cancels the plan, for example when an offer is withdrawn.\n\nScope: onboarding:write. Docs: https://passkey-x.com/api-docs#org-org-onboarding-cancel", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/onboarding/:plan_id/cancel", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "onboarding", ":plan_id", "cancel" ], "variable": [ { "key": "plan_id", "value": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "description": "The onboarding plan." } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "POST", "url": "{{orgBaseUrl}}/v1/onboarding/:plan_id/cancel" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"id\": \"a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d\",\n \"status\": \"cancelled\",\n \"due_at\": \"2026-10-26T09:30:00Z\",\n \"last_reminded_at\": null,\n \"reminders\": 0\n }\n}" } ] }, { "name": "Member security for audits (new in 1.2)", "request": { "method": "GET", "description": "Per-member vault health (counts only), device checks from the last 90 days, two-step and onboarding. Each export is audited.\n\nScope: reports:read. Docs: https://passkey-x.com/api-docs#org-org-member-security", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/member-security?offset=0&limit=100", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "member-security" ], "query": [ { "key": "offset", "value": "0", "description": "Rows to skip (default 0).", "disabled": false }, { "key": "limit", "value": "100", "description": "1–500 (default 100).", "disabled": false }, { "key": "cursor", "value": "", "description": "The next_cursor of the previous page (use instead of offset).", "disabled": true } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/member-security?offset=0&limit=100" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": [\n {\n \"identity_id\": \"5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9\",\n \"name\": \"Ana Ruiz\",\n \"email\": \"ana@example.com\",\n \"role\": \"member\",\n \"two_step\": true,\n \"last_sign_in_at\": \"2026-10-26T09:30:00Z\",\n \"health\": {\n \"score\": 91,\n \"logins\": 142,\n \"weak\": 1,\n \"reused\": 0,\n \"old\": 4,\n \"breached\": 0,\n \"missing_totp\": 6,\n \"passkeys\": 3,\n \"reported_at\": \"2026-10-26T09:30:00Z\"\n },\n \"devices\": [\n {\n \"platform\": \"android\",\n \"os\": \"Android 15\",\n \"app_version\": \"1.0.2\",\n \"last_seen_at\": \"2026-10-26T09:30:00Z\",\n \"score\": 100,\n \"checks\": {\n \"screen_lock\": true,\n \"rooted\": false,\n \"work_profile\": true\n }\n }\n ],\n \"onboarding\": {\n \"status\": \"completed\",\n \"due_at\": \"2026-10-26T09:30:00Z\",\n \"left\": 0\n }\n }\n ],\n \"next_offset\": 1,\n \"has_more\": false\n}" } ] } ] }, { "name": "Access handover", "item": [ { "name": "List handovers (new in 1.2)", "request": { "method": "GET", "description": "Recent handovers with how many handed-over passwords the successor has already changed.\n\nScope: handover:read. Docs: https://passkey-x.com/api-docs#org-org-handovers", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/handovers?limit=50", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "handovers" ], "query": [ { "key": "limit", "value": "50", "description": "1–200 (default 50).", "disabled": false }, { "key": "since", "value": "", "description": "Only rows created at or after this time (ISO 8601), for example 2026-10-01.", "disabled": true }, { "key": "until", "value": "", "description": "Only rows created before this time (ISO 8601).", "disabled": true }, { "key": "q", "value": "", "description": "Text search across the row (up to 100 characters).", "disabled": true }, { "key": "cursor", "value": "", "description": "The next_cursor of the previous page (use instead of offset).", "disabled": true } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/handovers?limit=50" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": [\n {\n \"id\": \"f1e2d3c4-b5a6-4978-8695-a4b3c2d1e0f9\",\n \"from_identity_id\": \"5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9\",\n \"from\": \"Ana Ruiz\",\n \"to_identity_id\": \"7a8b9c0d-1e2f-4a3b-8c4d-5e6f7a8b9c0d\",\n \"to\": \"Raj Patel\",\n \"workspaces\": 3,\n \"items\": 27,\n \"items_rotated\": 19,\n \"note\": \"HR ticket 4411\",\n \"created_at\": \"2026-10-26T09:30:00Z\"\n }\n ]\n}" } ] }, { "name": "Preview a handover (new in 1.2)", "request": { "method": "GET", "description": "The vaults the leaver owns or manages and the passwords they used in the last 90 days. Nothing changes.\n\nScope: handover:read. Docs: https://passkey-x.com/api-docs#org-org-handover-preview", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/handovers/preview?from=5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9&to=7a8b9c0d-1e2f-4a3b-8c4d-5e6f7a8b9c0d", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "handovers", "preview" ], "query": [ { "key": "from", "value": "5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9", "description": "The leaver's identity_id.", "disabled": false }, { "key": "to", "value": "7a8b9c0d-1e2f-4a3b-8c4d-5e6f7a8b9c0d", "description": "The successor's identity_id (optional).", "disabled": false } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/handovers/preview?from=5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9&to=7a8b9c0d-1e2f-4a3b-8c4d-5e6f7a8b9c0d" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"from\": \"Ana Ruiz\",\n \"to\": \"Raj Patel\",\n \"workspaces\": [\n {\n \"workspace_id\": \"3f2a1b0c-9d8e-4f7a-8b6c-5d4e3f2a1b0c\",\n \"role\": \"manager\",\n \"status\": \"active\",\n \"successor_role\": null,\n \"other_managers\": 1\n }\n ],\n \"items\": [\n {\n \"workspace_id\": \"3f2a1b0c-9d8e-4f7a-8b6c-5d4e3f2a1b0c\",\n \"item_id\": \"c0ffee00-1234-4abc-8def-0123456789ab\",\n \"last_used_at\": \"2026-10-26T09:30:00Z\",\n \"uses\": 12\n }\n ]\n }\n}" } ] }, { "name": "Hand over access (new in 1.2)", "request": { "method": "POST", "description": "Makes the successor a manager of every vault the leaver owns or manages and queues the passwords the leaver used for rotation. Vault keys are delivered from an administrator's device (Sharing & bundles), so access is end-to-end encrypted.\n\nScope: handover:write. Docs: https://passkey-x.com/api-docs#org-org-handover-create", "header": [ { "key": "Content-Type", "value": "application/json", "description": "JSON body" } ], "url": { "raw": "{{orgBaseUrl}}/v1/handovers", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "handovers" ] }, "body": { "mode": "raw", "raw": "{\n \"from_identity_id\": \"5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9\",\n \"to_identity_id\": \"7a8b9c0d-1e2f-4a3b-8c4d-5e6f7a8b9c0d\",\n \"note\": \"HR ticket 4411\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 201\", () => pm.response.to.have.status(201));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 201", "originalRequest": { "method": "POST", "url": "{{orgBaseUrl}}/v1/handovers" }, "status": "Created", "code": 201, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"id\": \"f1e2d3c4-b5a6-4978-8695-a4b3c2d1e0f9\",\n \"from_identity_id\": \"5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9\",\n \"to_identity_id\": \"7a8b9c0d-1e2f-4a3b-8c4d-5e6f7a8b9c0d\",\n \"workspaces\": 3,\n \"items\": 27,\n \"created_at\": \"2026-10-26T09:30:00Z\"\n }\n}" } ] } ] }, { "name": "Vaults, sharing and access", "item": [ { "name": "List shared vaults", "request": { "method": "GET", "description": "Shared vaults with kind, request label, member count and whether key rotation is due. Names are encrypted and never returned.\n\nScope: workspaces:read. Docs: https://passkey-x.com/api-docs#org-org-workspaces", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/workspaces", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "workspaces" ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/workspaces" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": [\n {\n \"id\": \"3f2a1b0c-9d8e-4f7a-8b6c-5d4e3f2a1b0c\",\n \"kind\": \"shared\",\n \"suite\": \"business\",\n \"status\": \"active\",\n \"request_label\": \"Finance\",\n \"key_rotation_required\": false,\n \"created_at\": \"2026-10-26T09:30:00Z\",\n \"members\": 14\n }\n ]\n}" } ] }, { "name": "List directory groups", "request": { "method": "GET", "description": "SCIM groups with member counts and the vaults each group maps to.\n\nScope: groups:read. Docs: https://passkey-x.com/api-docs#org-org-groups", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/groups", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "groups" ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/groups" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": [\n {\n \"id\": \"4a5b6c7d-8e9f-4a0b-9c1d-2e3f4a5b6c7d\",\n \"display_name\": \"Finance\",\n \"external_id\": \"okta-00g1\",\n \"created_at\": \"2026-10-26T09:30:00Z\",\n \"members\": 14,\n \"workspaces\": [\n {\n \"workspace_id\": \"3f2a1b0c-9d8e-4f7a-8b6c-5d4e3f2a1b0c\",\n \"role\": \"editor\"\n }\n ]\n }\n ]\n}" } ] }, { "name": "List vault access requests", "request": { "method": "GET", "description": "Requests for shared vaults with the reason and requested duration.\n\nScope: access:read. Docs: https://passkey-x.com/api-docs#org-org-access-requests", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/access-requests?status=pending&limit=50", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "access-requests" ], "query": [ { "key": "status", "value": "pending", "description": "pending, approved, denied or cancelled.", "disabled": false }, { "key": "limit", "value": "50", "description": "1–200 (default 50).", "disabled": false }, { "key": "since", "value": "", "description": "Only rows created at or after this time (ISO 8601), for example 2026-10-01.", "disabled": true }, { "key": "until", "value": "", "description": "Only rows created before this time (ISO 8601).", "disabled": true }, { "key": "q", "value": "", "description": "Text search across the row (up to 100 characters).", "disabled": true }, { "key": "cursor", "value": "", "description": "The next_cursor of the previous page (use instead of offset).", "disabled": true } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/access-requests?status=pending&limit=50" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": [\n {\n \"id\": \"9d8c7b6a-5f4e-4d3c-b2a1-0f9e8d7c6b5a\",\n \"workspace_id\": \"3f2a1b0c-9d8e-4f7a-8b6c-5d4e3f2a1b0c\",\n \"label\": \"Finance\",\n \"requester_identity_id\": \"5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9\",\n \"requester_name\": \"Ana Ruiz\",\n \"role\": \"viewer\",\n \"reason\": \"Quarter close\",\n \"duration_hours\": 8,\n \"status\": \"pending\",\n \"decided_via\": null,\n \"decision_note\": null,\n \"access_expires_at\": null,\n \"created_at\": \"2026-10-26T09:30:00Z\",\n \"decided_at\": null\n }\n ]\n}" } ] }, { "name": "Approve a vault request", "request": { "method": "POST", "description": "Approves; time-limited access ends automatically. A vault owner's device delivers the key.\n\nScope: access:write. Docs: https://passkey-x.com/api-docs#org-org-approve-access", "header": [ { "key": "Content-Type", "value": "application/json", "description": "JSON body" } ], "url": { "raw": "{{orgBaseUrl}}/v1/access-requests/:request_id/approve", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "access-requests", ":request_id", "approve" ], "variable": [ { "key": "request_id", "value": "9d8c7b6a-5f4e-4d3c-b2a1-0f9e8d7c6b5a", "description": "The request." } ] }, "body": { "mode": "raw", "raw": "{\n \"note\": \"Approved by the Service Desk (ticket INC-4411)\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "POST", "url": "{{orgBaseUrl}}/v1/access-requests/:request_id/approve" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"id\": \"9d8c7b6a-5f4e-4d3c-b2a1-0f9e8d7c6b5a\",\n \"status\": \"approved\",\n \"access_expires_at\": \"2026-10-26T17:30:00Z\"\n }\n}" } ] }, { "name": "Deny a vault request", "request": { "method": "POST", "description": "Declines the request.\n\nScope: access:write. Docs: https://passkey-x.com/api-docs#org-org-deny-access", "header": [ { "key": "Content-Type", "value": "application/json", "description": "JSON body" } ], "url": { "raw": "{{orgBaseUrl}}/v1/access-requests/:request_id/deny", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "access-requests", ":request_id", "deny" ], "variable": [ { "key": "request_id", "value": "9d8c7b6a-5f4e-4d3c-b2a1-0f9e8d7c6b5a", "description": "The request." } ] }, "body": { "mode": "raw", "raw": "{\n \"note\": \"Declined by the Service Desk (ticket INC-4411)\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "POST", "url": "{{orgBaseUrl}}/v1/access-requests/:request_id/deny" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"id\": \"9d8c7b6a-5f4e-4d3c-b2a1-0f9e8d7c6b5a\",\n \"status\": \"denied\",\n \"access_expires_at\": null\n }\n}" } ] }, { "name": "External sharing requests (new in 1.2)", "request": { "method": "GET", "description": "Secure Send links to people outside the organization that need (or had) approval: who, why, for whom, size and expiry — never the content.\n\nScope: sharing:read. Docs: https://passkey-x.com/api-docs#org-org-external-shares", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/external-shares?status=pending&limit=50", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "external-shares" ], "query": [ { "key": "status", "value": "pending", "description": "pending, approved or denied.", "disabled": false }, { "key": "limit", "value": "50", "description": "1–200 (default 50).", "disabled": false }, { "key": "since", "value": "", "description": "Only rows created at or after this time (ISO 8601), for example 2026-10-01.", "disabled": true }, { "key": "until", "value": "", "description": "Only rows created before this time (ISO 8601).", "disabled": true }, { "key": "q", "value": "", "description": "Text search across the row (up to 100 characters).", "disabled": true }, { "key": "cursor", "value": "", "description": "The next_cursor of the previous page (use instead of offset).", "disabled": true } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/external-shares?status=pending&limit=50" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": [\n {\n \"id\": \"b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e\",\n \"sender_id\": \"5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9\",\n \"sender\": \"Ana Ruiz\",\n \"kind\": \"text\",\n \"byte_size\": 312,\n \"reason\": \"Vendor onboarding\",\n \"recipient\": \"vendor@partner.example\",\n \"max_views\": 1,\n \"passphrase\": true,\n \"created_at\": \"2026-10-26T09:30:00Z\",\n \"expires_at\": \"2026-10-27T09:30:00Z\",\n \"status\": \"pending\",\n \"decided_at\": null,\n \"decided_by\": null,\n \"note\": null\n }\n ]\n}" } ] }, { "name": "Approve an external link (new in 1.2)", "request": { "method": "POST", "description": "The recipient can open the link from now on. The sender is emailed.\n\nScope: sharing:write. Docs: https://passkey-x.com/api-docs#org-org-approve-share", "header": [ { "key": "Content-Type", "value": "application/json", "description": "JSON body" } ], "url": { "raw": "{{orgBaseUrl}}/v1/external-shares/:link_id/approve", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "external-shares", ":link_id", "approve" ], "variable": [ { "key": "link_id", "value": "b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e", "description": "The Secure Send link." } ] }, "body": { "mode": "raw", "raw": "{\n \"note\": \"Approved for this vendor\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "POST", "url": "{{orgBaseUrl}}/v1/external-shares/:link_id/approve" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"id\": \"b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e\",\n \"status\": \"approved\",\n \"decided_at\": \"2026-10-26T09:30:00Z\"\n }\n}" } ] }, { "name": "Decline an external link (new in 1.2)", "request": { "method": "POST", "description": "Declines the link and deletes its encrypted content. The sender is emailed with your note.\n\nScope: sharing:write. Docs: https://passkey-x.com/api-docs#org-org-deny-share", "header": [ { "key": "Content-Type", "value": "application/json", "description": "JSON body" } ], "url": { "raw": "{{orgBaseUrl}}/v1/external-shares/:link_id/deny", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "external-shares", ":link_id", "deny" ], "variable": [ { "key": "link_id", "value": "b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e", "description": "The Secure Send link." } ] }, "body": { "mode": "raw", "raw": "{\n \"note\": \"Use the vendor portal instead\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "POST", "url": "{{orgBaseUrl}}/v1/external-shares/:link_id/deny" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"id\": \"b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e\",\n \"status\": \"denied\",\n \"decided_at\": \"2026-10-26T09:30:00Z\"\n }\n}" } ] } ] }, { "name": "Signatures", "item": [ { "name": "List signature requests (new in 1.6)", "request": { "method": "GET", "description": "Requests sent for signature, newest first, with how many have signed and who is still to sign (and whether they opened it). Filter pending ones to chase signers from your contract or HR system.\n\nScope: documents:read. Docs: https://passkey-x.com/api-docs#org-org-signature-requests", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/signature-requests?status=pending&limit=100", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "signature-requests" ], "query": [ { "key": "status", "value": "pending", "description": "pending, sealed, declined, revoked, lapsed or expired.", "disabled": false }, { "key": "limit", "value": "100", "description": "1–500 (default 100).", "disabled": false } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/signature-requests?status=pending&limit=100" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": [\n {\n \"id\": \"e5f6a7b8-c9d0-4e1f-9a2b-3c4d5e6f7a8b\",\n \"label\": \"Offer letter\",\n \"doc_type\": \"contract\",\n \"status\": \"pending\",\n \"cancelled\": false,\n \"signing_order\": \"sequential\",\n \"verify_code\": \"PX-7K2M-QW9D-HT4R-B8NC\",\n \"created_by_name\": \"Ravi Kumar\",\n \"created_at\": \"2026-10-26T09:30:00Z\",\n \"request_deadline\": null,\n \"signed\": 1,\n \"total\": 2,\n \"waiting_for\": [\n {\n \"signer_id\": \"b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e\",\n \"kind\": \"external\",\n \"position\": 2,\n \"status\": \"pending\",\n \"name\": \"Priya Shah\",\n \"viewed_at\": \"2026-10-26T09:30:00Z\"\n }\n ]\n }\n ],\n \"has_more\": false,\n \"next_cursor\": null\n}" } ] }, { "name": "Cancel a signature request (new in 1.6)", "request": { "method": "POST", "description": "Cancels a pending request: outside signers' links stop working, their copy of the document is deleted, and members see it as cancelled. Recorded in the Seal Chain and the audit log (document.request_cancelled) as the key's owner.\n\nScope: signatures:write. Docs: https://passkey-x.com/api-docs#org-org-signature-cancel", "header": [ { "key": "Content-Type", "value": "application/json", "description": "JSON body" } ], "url": { "raw": "{{orgBaseUrl}}/v1/documents/:document_id/cancel", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "documents", ":document_id", "cancel" ], "variable": [ { "key": "document_id", "value": "e5f6a7b8-c9d0-4e1f-9a2b-3c4d5e6f7a8b", "description": "The signature request." } ] }, "body": { "mode": "raw", "raw": "{\n \"reason\": \"Replaced by version 2\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "POST", "url": "{{orgBaseUrl}}/v1/documents/:document_id/cancel" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"id\": \"e5f6a7b8-c9d0-4e1f-9a2b-3c4d5e6f7a8b\",\n \"status\": \"revoked\",\n \"cancelled\": true,\n \"revoked_at\": \"2026-10-26T09:30:00Z\",\n \"reason\": \"Replaced by version 2\"\n }\n}" } ] } ] }, { "name": "Webhooks", "item": [ { "name": "Event catalog (new in 1.6)", "request": { "method": "GET", "description": "Every event a webhook can subscribe to, with its category. A filter that names one of these events matches that event only; any other filter (such as member.) is a prefix.\n\nScope: webhooks:read. Docs: https://passkey-x.com/api-docs#org-org-webhook-events", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/webhooks/events", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "webhooks", "events" ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/webhooks/events" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": [\n {\n \"event\": \"document.signed\",\n \"category\": \"documents\",\n \"description\": \"A signer signed a document (with the proof summary)\"\n },\n {\n \"event\": \"security_alert.raised\",\n \"category\": \"security\",\n \"description\": \"A security alert was raised\"\n }\n ]\n}" } ] }, { "name": "List webhooks (new in 1.6)", "request": { "method": "GET", "description": "The organization's webhooks and SIEM destinations (at most 5) with their events, health and last delivery. Secrets are never returned.\n\nScope: webhooks:read. Docs: https://passkey-x.com/api-docs#org-org-webhooks", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/webhooks", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "webhooks" ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/webhooks" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": [\n {\n \"id\": \"f1e2d3c4-b5a6-4978-8a9b-0c1d2e3f4a5b\",\n \"name\": \"Contracts\",\n \"url\": \"https://contracts.example.com/passkey-x\",\n \"format\": \"generic\",\n \"events\": [\n \"document.sealed\",\n \"document.signed\"\n ],\n \"enabled\": true,\n \"created_at\": \"2026-10-26T09:30:00Z\",\n \"delivered_through\": 18342,\n \"failure_count\": 0,\n \"last_success_at\": \"2026-10-26T09:30:00Z\",\n \"last_status\": 200,\n \"last_error\": null,\n \"health\": \"delivering\"\n }\n ]\n}" } ] }, { "name": "Create a webhook (new in 1.6)", "request": { "method": "POST", "description": "Creates an HTTPS webhook (public address only) that starts with the next event. The signing secret (pxwh_…) is returned once; an idempotent replay returns it as null. Leave events out to receive everything.\n\nScope: webhooks:write. Docs: https://passkey-x.com/api-docs#org-org-webhook-create", "header": [ { "key": "Idempotency-Key", "value": "contracts-hook-001", "description": "8–128 characters; repeats within 24 hours return the first answer (without the secret)." }, { "key": "Content-Type", "value": "application/json", "description": "JSON body" } ], "url": { "raw": "{{orgBaseUrl}}/v1/webhooks", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "webhooks" ] }, "body": { "mode": "raw", "raw": "{\n \"name\": \"Contracts\",\n \"url\": \"https://contracts.example.com/passkey-x\",\n \"events\": [\n \"document.signed\",\n \"document.declined\",\n \"document.sealed\",\n \"document.request_cancelled\"\n ]\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 201\", () => pm.response.to.have.status(201));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 201", "originalRequest": { "method": "POST", "url": "{{orgBaseUrl}}/v1/webhooks" }, "status": "Created", "code": 201, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"id\": \"f1e2d3c4-b5a6-4978-8a9b-0c1d2e3f4a5b\",\n \"name\": \"Contracts\",\n \"url\": \"https://contracts.example.com/passkey-x\",\n \"events\": [\n \"document.declined\",\n \"document.request_cancelled\",\n \"document.sealed\",\n \"document.signed\"\n ],\n \"enabled\": true,\n \"health\": \"waiting\",\n \"secret\": \"pxwh_\"\n }\n}" } ] }, { "name": "One webhook (new in 1.6)", "request": { "method": "GET", "description": "A webhook's events, health, cursor (delivered_through) and last attempt.\n\nScope: webhooks:read. Docs: https://passkey-x.com/api-docs#org-org-webhook", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/webhooks/:webhook_id", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "webhooks", ":webhook_id" ], "variable": [ { "key": "webhook_id", "value": "f1e2d3c4-b5a6-4978-8a9b-0c1d2e3f4a5b", "description": "The webhook." } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/webhooks/:webhook_id" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"id\": \"f1e2d3c4-b5a6-4978-8a9b-0c1d2e3f4a5b\",\n \"name\": \"Contracts\",\n \"events\": [\n \"document.signed\"\n ],\n \"enabled\": true,\n \"delivered_through\": 18342,\n \"health\": \"delivering\"\n }\n}" } ] }, { "name": "Change a webhook (new in 1.6)", "request": { "method": "PATCH", "description": "Renames it, pauses or resumes it (resuming clears the failure count) or replaces its events (an empty list means every event).\n\nScope: webhooks:write. Docs: https://passkey-x.com/api-docs#org-org-webhook-update", "header": [ { "key": "Content-Type", "value": "application/json", "description": "JSON body" } ], "url": { "raw": "{{orgBaseUrl}}/v1/webhooks/:webhook_id", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "webhooks", ":webhook_id" ], "variable": [ { "key": "webhook_id", "value": "f1e2d3c4-b5a6-4978-8a9b-0c1d2e3f4a5b", "description": "The webhook." } ] }, "body": { "mode": "raw", "raw": "{\n \"enabled\": true,\n \"events\": [\n \"document.\",\n \"security_alert.raised\"\n ]\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "PATCH", "url": "{{orgBaseUrl}}/v1/webhooks/:webhook_id" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"id\": \"f1e2d3c4-b5a6-4978-8a9b-0c1d2e3f4a5b\",\n \"name\": \"Contracts\",\n \"events\": [\n \"document.\",\n \"security_alert.raised\"\n ],\n \"enabled\": true,\n \"health\": \"waiting\"\n }\n}" } ] }, { "name": "Delete a webhook (new in 1.6)", "request": { "method": "DELETE", "description": "Stops deliveries and deletes the webhook and its delivery log.\n\nScope: webhooks:write. Docs: https://passkey-x.com/api-docs#org-org-webhook-delete", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/webhooks/:webhook_id", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "webhooks", ":webhook_id" ], "variable": [ { "key": "webhook_id", "value": "f1e2d3c4-b5a6-4978-8a9b-0c1d2e3f4a5b", "description": "The webhook." } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "DELETE", "url": "{{orgBaseUrl}}/v1/webhooks/:webhook_id" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"id\": \"f1e2d3c4-b5a6-4978-8a9b-0c1d2e3f4a5b\",\n \"deleted\": true\n }\n}" } ] }, { "name": "Rotate the signing secret (new in 1.6)", "request": { "method": "POST", "description": "Replaces the secret at once and returns the new one (shown once). Deploy it to your receiver right away.\n\nScope: webhooks:write. Docs: https://passkey-x.com/api-docs#org-org-webhook-rotate", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/webhooks/:webhook_id/rotate-secret", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "webhooks", ":webhook_id", "rotate-secret" ], "variable": [ { "key": "webhook_id", "value": "f1e2d3c4-b5a6-4978-8a9b-0c1d2e3f4a5b", "description": "The webhook." } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "POST", "url": "{{orgBaseUrl}}/v1/webhooks/:webhook_id/rotate-secret" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"id\": \"f1e2d3c4-b5a6-4978-8a9b-0c1d2e3f4a5b\",\n \"secret\": \"pxwh_\"\n }\n}" } ] }, { "name": "Send a test (new in 1.6)", "request": { "method": "POST", "description": "Sends one signed audit_webhook.test event. The result appears in the delivery log within a few seconds. One test every 10 seconds.\n\nScope: webhooks:write. Docs: https://passkey-x.com/api-docs#org-org-webhook-test", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/webhooks/:webhook_id/test", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "webhooks", ":webhook_id", "test" ], "variable": [ { "key": "webhook_id", "value": "f1e2d3c4-b5a6-4978-8a9b-0c1d2e3f4a5b", "description": "The webhook." } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 202\", () => pm.response.to.have.status(202));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 202", "originalRequest": { "method": "POST", "url": "{{orgBaseUrl}}/v1/webhooks/:webhook_id/test" }, "status": "OK", "code": 202, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"id\": \"f1e2d3c4-b5a6-4978-8a9b-0c1d2e3f4a5b\",\n \"test_sent_at\": \"2026-10-26T09:30:00Z\"\n }\n}" } ] }, { "name": "Delivery log (new in 1.6)", "request": { "method": "GET", "description": "Recent delivery attempts and tests, newest first (the latest 200 are kept).\n\nScope: webhooks:read. Docs: https://passkey-x.com/api-docs#org-org-webhook-deliveries", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/webhooks/:webhook_id/deliveries?limit=50", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "webhooks", ":webhook_id", "deliveries" ], "query": [ { "key": "limit", "value": "50", "description": "1–200 (default 50).", "disabled": false } ], "variable": [ { "key": "webhook_id", "value": "f1e2d3c4-b5a6-4978-8a9b-0c1d2e3f4a5b", "description": "The webhook." } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/webhooks/:webhook_id/deliveries?limit=50" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": [\n {\n \"id\": 981,\n \"kind\": \"delivery\",\n \"ok\": true,\n \"status\": 200,\n \"error\": null,\n \"through_sequence\": 18342,\n \"created_at\": \"2026-10-26T09:30:00Z\"\n }\n ]\n}" } ] }, { "name": "Replay events (new in 1.6)", "request": { "method": "POST", "description": "Sends events again starting at from_sequence (an audit event of the last 30 days), for example after your receiver lost data. Deliveries stay in order; deduplicate on sequence.\n\nScope: webhooks:write. Docs: https://passkey-x.com/api-docs#org-org-webhook-replay", "header": [ { "key": "Content-Type", "value": "application/json", "description": "JSON body" } ], "url": { "raw": "{{orgBaseUrl}}/v1/webhooks/:webhook_id/replay", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "webhooks", ":webhook_id", "replay" ], "variable": [ { "key": "webhook_id", "value": "f1e2d3c4-b5a6-4978-8a9b-0c1d2e3f4a5b", "description": "The webhook." } ] }, "body": { "mode": "raw", "raw": "{\n \"from_sequence\": 18001\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "POST", "url": "{{orgBaseUrl}}/v1/webhooks/:webhook_id/replay" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"id\": \"f1e2d3c4-b5a6-4978-8a9b-0c1d2e3f4a5b\",\n \"from_sequence\": 18001,\n \"delivered_through\": 18000\n }\n}" } ] } ] }, { "name": "Controller", "item": [ { "name": "Computers, groups and recent actions (new in 1.7)", "request": { "method": "GET", "description": "Every active computer the Controller manages (platform, versions, online, score, baseline and drift, lost mode, Seal Chain state, update state), the groups with their update rings, and the latest 100 actions. Needs the Controller (Business and Enterprise).\n\nScope: controller:read. Docs: https://passkey-x.com/api-docs#org-org-controller", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/controller", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "controller" ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/controller" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"computers\": [\n {\n \"id\": \"1c2d3e4f-5a6b-4c7d-8e9f-0a1b2c3d4e5f\",\n \"name\": \"FIN-LAPTOP-07\",\n \"platform\": \"windows\",\n \"group_id\": \"2d3e4f5a-6b7c-4d8e-9f0a-1b2c3d4e5f6a\",\n \"controller_version\": \"1.4.0\",\n \"app_version\": \"1.18.0\",\n \"service_mode\": true,\n \"last_checkin_at\": \"2026-10-26T09:30:00Z\",\n \"online\": true,\n \"score\": 92,\n \"baseline_version\": 4,\n \"baseline_mode\": \"enforce\",\n \"drift\": 0,\n \"lost\": false,\n \"chain_intact\": true,\n \"chain_length\": 1288,\n \"update_state\": \"current\"\n }\n ],\n \"groups\": [\n {\n \"id\": \"2d3e4f5a-6b7c-4d8e-9f0a-1b2c3d4e5f6a\",\n \"name\": \"Finance\",\n \"kind\": \"department\",\n \"mode\": \"enforce\",\n \"baseline_version\": 4,\n \"update_channel\": \"stable\",\n \"pinned_version\": null,\n \"rollout_percent\": 100,\n \"halted\": false,\n \"halted_reason\": null\n }\n ],\n \"jobs\": [\n {\n \"id\": \"3e4f5a6b-7c8d-4e9f-8a1b-2c3d4e5f6a7b\",\n \"kind\": \"scan\",\n \"status\": \"running\",\n \"target_kind\": \"group\",\n \"computers\": 18,\n \"group_id\": \"2d3e4f5a-6b7c-4d8e-9f0a-1b2c3d4e5f6a\",\n \"reason\": \"Weekly check\",\n \"source\": \"api\",\n \"created_at\": \"2026-10-26T09:30:00Z\",\n \"finished_at\": null\n }\n ]\n }\n}" } ] }, { "name": "Run an action on computers (new in 1.7)", "request": { "method": "POST", "description": "Queues an action for computers, a group or every computer, in the name of the key's owner (recorded as source \"api\"). Actions that need no signature: lock_screen, message, scan, diagnostics, sync_now, update_app, update_controller, found, app_lock, app_sign_out, app_sync, app_message, and on Controller Enterprise rotate_password and end_elevation. Restart, shutdown, settings, install, uninstall, elevate, wipe and lost mode must be signed by an administrator in the admin console and answer 403 signature_required. Actions expire after 72 hours if a computer never checks in.\n\nScope: controller:write. Docs: https://passkey-x.com/api-docs#org-org-controller-job-create", "header": [ { "key": "Idempotency-Key", "value": "scan-finance-2026-10-26", "description": "8–128 characters; a repeat within 24 hours returns the first answer." }, { "key": "Content-Type", "value": "application/json", "description": "JSON body" } ], "url": { "raw": "{{orgBaseUrl}}/v1/controller/jobs", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "controller", "jobs" ] }, "body": { "mode": "raw", "raw": "{\n \"kind\": \"scan\",\n \"target_kind\": \"group\",\n \"group_id\": \"2d3e4f5a-6b7c-4d8e-9f0a-1b2c3d4e5f6a\",\n \"computer_ids\": [],\n \"payload\": {},\n \"reason\": \"Weekly check\"\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 201\", () => pm.response.to.have.status(201));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 201", "originalRequest": { "method": "POST", "url": "{{orgBaseUrl}}/v1/controller/jobs" }, "status": "Created", "code": 201, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"id\": \"3e4f5a6b-7c8d-4e9f-8a1b-2c3d4e5f6a7b\",\n \"status\": \"queued\"\n }\n}" } ] }, { "name": "One action and its results (new in 1.7)", "request": { "method": "GET", "description": "An action's status and payload with one run per computer: sent, done, failed or skipped, the computer's detail message and whether its Seal Chain entry verified.\n\nScope: controller:read. Docs: https://passkey-x.com/api-docs#org-org-controller-job", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/controller/jobs/:job_id", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "controller", "jobs", ":job_id" ], "variable": [ { "key": "job_id", "value": "3e4f5a6b-7c8d-4e9f-8a1b-2c3d4e5f6a7b", "description": "The action." } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/controller/jobs/:job_id" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"id\": \"3e4f5a6b-7c8d-4e9f-8a1b-2c3d4e5f6a7b\",\n \"kind\": \"scan\",\n \"status\": \"done\",\n \"payload\": {},\n \"reason\": \"Weekly check\",\n \"source\": \"api\",\n \"created_at\": \"2026-10-26T09:30:00Z\",\n \"expires_at\": \"2026-10-29T09:30:00Z\",\n \"finished_at\": \"2026-10-26T09:30:00Z\",\n \"runs\": [\n {\n \"computer_id\": \"1c2d3e4f-5a6b-4c7d-8e9f-0a1b2c3d4e5f\",\n \"status\": \"done\",\n \"detail\": \"No issues found\",\n \"updated_at\": \"2026-10-26T09:30:00Z\",\n \"chain_ok\": true\n }\n ]\n }\n}" } ] } ] }, { "name": "Remote", "item": [ { "name": "Seats, devices and sessions (new in 1.7)", "request": { "method": "GET", "description": "Remote seats (bought and given), the devices enrolled for unattended or attended access (online when seen in the last 2 minutes) and the latest 200 sessions with who started them, the device, access (view or control), participants and how they ended. Screens, input and chat are end-to-end encrypted and never reach the API.\n\nScope: remote:read. Docs: https://passkey-x.com/api-docs#org-org-remote", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/remote", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "remote" ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/remote" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"seats\": {\n \"total\": 3,\n \"assigned\": 2\n },\n \"devices\": [\n {\n \"id\": \"4f5a6b7c-8d9e-4f0a-9b2c-3d4e5f6a7b8c\",\n \"label\": \"Reception PC\",\n \"platform\": \"windows\",\n \"can_control\": true,\n \"unattended\": true,\n \"online\": true,\n \"last_seen_at\": \"2026-10-26T09:30:00Z\"\n }\n ],\n \"sessions\": [\n {\n \"id\": \"5a6b7c8d-9e0f-4a1b-8c3d-4e5f6a7b8c9d\",\n \"kind\": \"support\",\n \"title\": \"Printer setup\",\n \"status\": \"ended\",\n \"access\": \"control\",\n \"unattended\": false,\n \"started_by\": \"Ravi Kumar\",\n \"host\": \"Ana Ruiz\",\n \"device\": null,\n \"created_at\": \"2026-10-26T09:30:00Z\",\n \"started_at\": \"2026-10-26T09:30:00Z\",\n \"ended_at\": \"2026-10-26T09:30:00Z\",\n \"end_reason\": \"host\",\n \"participants\": 2\n }\n ]\n }\n}" } ] }, { "name": "End a session (new in 1.7)", "request": { "method": "POST", "description": "Ends a live session for everyone (screen sharing, control and any recording stop). Recorded as remote.session_ended with source api.\n\nScope: remote:write. Docs: https://passkey-x.com/api-docs#org-org-remote-end", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/remote/sessions/:session_id/end", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "remote", "sessions", ":session_id", "end" ], "variable": [ { "key": "session_id", "value": "5a6b7c8d-9e0f-4a1b-8c3d-4e5f6a7b8c9d", "description": "The session." } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "POST", "url": "{{orgBaseUrl}}/v1/remote/sessions/:session_id/end" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": true\n}" } ] }, { "name": "List invite links (new in 1.7)", "request": { "method": "GET", "description": "The latest 200 invite links for people outside the organization (open, used, revoked or expired) with the access they asked for and the session they joined.\n\nScope: remote:read. Docs: https://passkey-x.com/api-docs#org-org-remote-invites", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/remote/invites", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "remote", "invites" ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{orgBaseUrl}}/v1/remote/invites" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": [\n {\n \"id\": \"6b7c8d9e-0f1a-4b2c-9d4e-5f6a7b8c9d0e\",\n \"email\": \"customer@example.com\",\n \"note\": \"Ticket 4411\",\n \"requested_access\": \"control\",\n \"status\": \"open\",\n \"expires_at\": \"2026-10-27T09:30:00Z\",\n \"session_id\": null,\n \"source\": \"api\",\n \"created_at\": \"2026-10-26T09:30:00Z\"\n }\n ]\n}" } ] }, { "name": "Create an invite link (new in 1.7)", "request": { "method": "POST", "description": "Creates a one-time link that lets someone outside the organization share their screen with the key's owner (who needs a Remote seat), for example from your helpdesk when a ticket is opened. Access is view or control (default control; the person still chooses on their device), valid 1–168 hours (default 24). The secret travels in the link's #fragment, which browsers never send to a server.\n\nScope: remote:write. Docs: https://passkey-x.com/api-docs#org-org-remote-invite-create", "header": [ { "key": "Idempotency-Key", "value": "ticket-4411-remote", "description": "8–128 characters; a repeat within 24 hours returns the first answer." }, { "key": "Content-Type", "value": "application/json", "description": "JSON body" } ], "url": { "raw": "{{orgBaseUrl}}/v1/remote/invites", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "remote", "invites" ] }, "body": { "mode": "raw", "raw": "{\n \"email\": \"customer@example.com\",\n \"note\": \"Ticket 4411\",\n \"access\": \"control\",\n \"hours\": 24\n}", "options": { "raw": { "language": "json" } } } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 201\", () => pm.response.to.have.status(201));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 201", "originalRequest": { "method": "POST", "url": "{{orgBaseUrl}}/v1/remote/invites" }, "status": "Created", "code": 201, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": {\n \"invite_id\": \"6b7c8d9e-0f1a-4b2c-9d4e-5f6a7b8c9d0e\",\n \"url\": \"https://passkey-x.com/?view=remote#invite=\",\n \"expires_at\": \"2026-10-27T09:30:00Z\"\n }\n}" } ] }, { "name": "Revoke an invite link (new in 1.7)", "request": { "method": "DELETE", "description": "The link stops working at once. Recorded as remote.invite_revoked.\n\nScope: remote:write. Docs: https://passkey-x.com/api-docs#org-org-remote-invite-revoke", "header": [], "url": { "raw": "{{orgBaseUrl}}/v1/remote/invites/:invite_id", "host": [ "{{orgBaseUrl}}" ], "path": [ "v1", "remote", "invites", ":invite_id" ], "variable": [ { "key": "invite_id", "value": "6b7c8d9e-0f1a-4b2c-9d4e-5f6a7b8c9d0e", "description": "The invite." } ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "DELETE", "url": "{{orgBaseUrl}}/v1/remote/invites/:invite_id" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"data\": true\n}" } ] } ] } ] }, { "name": "Agent API", "description": "The one-time agent token from Admin console → Agents. Rate limit: One request per second per agent.", "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{agentToken}}", "type": "string" } ] }, "event": [ { "listen": "prerequest", "script": { "type": "text/javascript", "exec": [ "const value = pm.variables.get(\"agentToken\");", "if (!value && pm.request.auth && pm.request.auth.type !== \"noauth\") {", " throw new Error(\"Set the agentToken variable first (Agent token (pxa1..)). The one-time agent token from Admin console → Agents.\");", "}" ] } } ], "item": [ { "name": "Vaults", "item": [ { "name": "Read shared vaults", "request": { "method": "GET", "description": "Every vault shared with the agent: its sealed vault key and each item's current revision, all ciphertext. The passkey-x agent command decrypts it on the agent's own machine.\n\nAuth: Agent token. Docs: https://passkey-x.com/api-docs#agent-agent-vaults", "header": [], "url": { "raw": "{{agentBaseUrl}}/v1/vaults", "host": [ "{{agentBaseUrl}}" ], "path": [ "v1", "vaults" ] } }, "event": [ { "listen": "test", "script": { "type": "text/javascript", "exec": [ "pm.test(\"Status is 200\", () => pm.response.to.have.status(200));", "pm.test(\"Has a request id\", () => pm.expect(pm.response.headers.get(\"x-request-id\") || pm.response.headers.get(\"X-Request-Id\")).to.be.ok);", "pm.test(\"Body is JSON without an error\", () => { const body = pm.response.json(); pm.expect(body.error).to.be.undefined; });" ] } } ], "response": [ { "name": "Example 200", "originalRequest": { "method": "GET", "url": "{{agentBaseUrl}}/v1/vaults" }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"agent_id\": \"6b7c8d9e-0f1a-4b2c-9d3e-4f5a6b7c8d9e\",\n \"tenant_id\": \"8b6a3f1e-2c4d-4e5f-9a0b-1c2d3e4f5a6b\",\n \"identity_id\": \"5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9\",\n \"name\": \"Deploy pipeline\",\n \"vaults\": [\n {\n \"workspace_id\": \"3f2a1b0c-9d8e-4f7a-8b6c-5d4e3f2a1b0c\",\n \"key_version\": 1,\n \"name\": {\n \"nonce\": \"\\\\xa1a1a1a1a1a1a1a1a1a1a1a1\",\n \"ciphertext\": \"\\\\x9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c\"\n },\n \"grant\": {\n \"ephemeral_public_key\": \"\\\\x04…\",\n \"nonce\": \"\\\\xa1a1a1a1a1a1a1a1a1a1a1a1\",\n \"ciphertext\": \"\\\\x9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c\"\n },\n \"items\": [\n {\n \"id\": \"c0ffee00-1234-4abc-8def-0123456789ab\",\n \"content_type\": \"api-key\",\n \"schema_version\": 1,\n \"revision\": 3,\n \"nonce\": \"\\\\xa1a1a1a1a1a1a1a1a1a1a1a1\",\n \"ciphertext\": \"\\\\x9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c9f3c\",\n \"aad_hash\": \"\\\\x5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d5d\",\n \"key_version\": 1\n }\n ]\n }\n ]\n}" } ] } ] } ] } ] }