Access API

AuthenticationCopy Anchor Link

Use your authenticated dashboard session. Requests that change configuration must include the dashboard's exact Origin header. Replace SITE-ID and ACCOUNT-ID with the website and account IDs.

Read the current revision before saving and include it in the PUT body. The response contains the new revision and redacted configuration. For an initial configuration, use an empty revision.

Configure Zero Trust after creating the website. General website edits preserve its Zero Trust settings.

Configuration payloadCopy Anchor Link

This example protects /admin for one verified email address:

Save providers through the account endpoint first. Its GET and PUT responses contain config (redacted providers, revision, and any setup notice) and websites (IDs, hostnames, and aliases for callback setup). Use config.revision for provider updates.

Account provider PUT body:

{
  "revision": "CURRENT-ACCOUNT-PROVIDER-REVISION",
  "providers": [{
    "id": "company-google",
    "name": "Google",
    "kind": "google",
    "client_id": "GOOGLE-CLIENT-ID",
    "client_secret": "GOOGLE-CLIENT-SECRET"
  }]
}

Website application PUT body:

{
  "revision": "CURRENT-REVISION",
  "applications": [{
    "id": "administration",
    "name": "Administration",
    "enabled": true,
    "hostname": "private.example.com",
    "path": "/admin",
    "session_seconds": 3600,
    "provider_ids": ["company-google"],
    "policies": [{
      "id": "administrators",
      "name": "Administrators",
      "action": "allow",
      "emails": ["admin@example.com"],
      "email_domains": [],
      "subjects": []
    }]
  }]
}

A blank provider secret retains the saved value only if the provider, client ID, and credential endpoints are unchanged. Supply a new secret when changing those values.

Provider updates invalidate application sessions across the account. Deleting a provider referenced by any application fails. A stale revision returns HTTP 409; reload before retrying.

Access activityCopy Anchor Link

Responses contain up to 100 events and a next_cursor for pagination. Use the dashboard's Export all logs action to download all available activity.

LimitsCopy Anchor Link

Provider IDs must be unique within the account. Application IDs must be unique within each website. Website payloads must omit providers; website provider writes are rejected with an account setup notice. See Access policies for selector behavior.