Authentication
Every request needs your API Key in the x-api-key header.
curl https://api.customer.onsim.uk/v1/users \ -H "x-api-key: $ONSIM_API_KEY"One key for each Customer
Section titled “One key for each Customer”A Customer holds one API Key. The key belongs to the Customer, not to the person who made it.
A key starts with onsim_live_, and 32 letters and digits follow. Treat the whole value as a secret.
Make the key
Section titled “Make the key”The account owner or a Super Admin makes the key in app.onsim, under Settings, on the API tab. ONSIM support can also do it for you.
app.onsim shows the key once, when it is made. Keep it in a secret store. After that, app.onsim shows only the last 4 characters, so that you can tell which key is in use.
Rotation replaces the key at once
Section titled “Rotation replaces the key at once”When someone regenerates the key, the old key stops working at that moment. There is no period in which both keys work. Put the new key in your systems as soon as you make it.
Revoke the key
Section titled “Revoke the key”When someone revokes the key, it stops working at that moment. Your Customer then has no key until someone makes a new one.
What the key can do
Section titled “What the key can do”The key identifies your Customer. Every request then reads only that Customer’s own resources. An ID that belongs to another Customer answers 404.
A request with no key, or with a key that is not valid, answers 403 with the invalid-api-key problem.