Authentication¶
The Data API accepts the same Authorization: Bearer … header as the web application, with two token types.
API key (recommended for integrations)¶
| Item | Detail |
|---|---|
| Header | Authorization: Bearer <full-api-key> |
| Format | rda_live_… (shown once at creation) |
| Scope | Read-only access to zones assigned at key creation |
| Storage | Bcrypt hash in MongoDB api_keys collection |
Create a key¶
cd rda_back
python scripts/create_api_key.py --name "ETL" --zone-id <zoneObjectId>
Optional: assign multiple zones by repeating --zone-id.
List and revoke¶
python scripts/manage_api_keys.py list
python scripts/manage_api_keys.py revoke --id <keyObjectId>
python scripts/manage_api_keys.py revoke --prefix rda_live_
list shows only the 16-character key prefix, never the full secret.
Zone scoping¶
An API key builds a viewer-scoped access context with the key's zoneIds. Requests for scans, sources, or locations outside those zones return 403 Forbidden.
JWT (user session)¶
| Item | Detail |
|---|---|
| Header | Authorization: Bearer <jwt> |
| Obtained via | POST /api/auth/login with { "email", "password" } |
| Scope | Same zone rules as the web UI for that user |
Useful for ad-hoc testing; prefer API keys for unattended integrations.
Errors¶
| HTTP | Code | Meaning |
|---|---|---|
| 401 | UNAUTHORIZED |
Missing, invalid, or revoked token |
| 403 | FORBIDDEN |
Resource outside your zones |
| 404 | NOT_FOUND |
Unknown scan, track, or export job |
Environment variables (CLI)¶
| Variable | Purpose |
|---|---|
RDA_API_BASE_URL |
Full API base (default http://localhost:9006/api) |
RDA_API_KEY |
Bearer token for scripts |
RDA_API_EMAIL / RDA_API_PASSWORD |
Alternative: JWT login in fetch_integration_data.py |