v1 · API reference

API keys

Create and revoke the API keys your integrations authenticate with. These endpoints are session-gated (dashboard cookie + `apikeys:manage`) and NOT usable with a Bearer API key.

Base URL: https://www.unitpost.com/api/v1/api/v1

API keys

List API keys

GET/api/v1/api/v1/api-keys

GET /api-keys

curl -X GET 'https://www.unitpost.com/api/v1/api/v1/api-keys' \
  -H 'Authorization: Bearer YOUR_API_KEY'

Response · 200

{
  "object": "list",
  "has_more": false,
  "data": [
    {
      "object": "api_key",
      "id": "id_123",
      "name": "Example",
      "prefix": "string",
      "scope": "full",
      "capabilities": [
        "string"
      ],
      "last_used_at": "2026-01-01T00:00:00.000Z",
      "revoked_at": "2026-01-01T00:00:00.000Z",
      "created_at": "2026-01-01T00:00:00.000Z"
    }
  ]
}

Retrieve a list of your workspace's API keys — the key prefix and metadata only, never the secret. Create a new key with Create an API key or revoke one with Revoke an API key. This endpoint is session-gated: it requires a dashboard session and cannot be called with a Bearer API key.

Parameters3 fields

Field	Type	Description
`limit`	integer · query	Max rows to return (default 20, max 100).
`after`	string · query	Return rows after this id (forward paging).
`before`	string · query	Return rows before this id (backward paging).

Response · 200 fields9 fields

Field	Type	Description
`object`required	string	—
`id`required	string	—
`name`required	string	—
`prefix`required	string	—
`scope`required	enumfull \| sending \| read_only	—
`capabilities`required	string[]	—
`last_used_at`required	object	—
`revoked_at`required	object	—
`created_at`required	string	—

200401403422

Create an API key

POST/api/v1/api/v1/api-keys

POST /api-keys

curl -X POST 'https://www.unitpost.com/api/v1/api/v1/api-keys' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "Production server",
    "capabilities": [
      "emails:send"
    ]
  }'

Response · 201

{
  "object": "api_key",
  "id": "id_123",
  "name": "Example",
  "prefix": "string",
  "scope": "full",
  "capabilities": [
    "string"
  ],
  "last_used_at": "2026-01-01T00:00:00.000Z",
  "revoked_at": "2026-01-01T00:00:00.000Z",
  "created_at": "2026-01-01T00:00:00.000Z",
  "key": "string"
}

Create an API key scoped to the capabilities you choose. The response includes the plaintext key exactly once — store it securely now, because it can never be retrieved again (only revoked). This endpoint is session-gated: it requires a dashboard session and cannot be called with a Bearer API key.

Request body3 fields

Field	Type	Description
`name`required	string	—
`scope`	enumfull \| sending \| read_only	—
`capabilities`	enum[]	—

Response · 201 fields10 fields

Field	Type	Description
`object`required	string	—
`id`required	string	—
`name`required	string	—
`prefix`required	string	—
`scope`required	enumfull \| sending \| read_only	—
`capabilities`required	string[]	—
`last_used_at`required	object	—
`revoked_at`required	object	—
`created_at`required	string	—
`key`required	string	The plaintext secret. Shown exactly once — store it now; it can never be retrieved again.

201401403422

Revoke an API key

DELETE/api/v1/api/v1/api-keys/{id}

DELETE /api-keys/{id}

curl -X DELETE 'https://www.unitpost.com/api/v1/api/v1/api-keys/key_123' \
  -H 'Authorization: Bearer YOUR_API_KEY'

Permanently revoke an API key. Requests made with it start failing with 401 immediately, and revocation cannot be undone — create a replacement first with Create an API key if you're rotating. This endpoint is session-gated: it requires a dashboard session and cannot be called with a Bearer API key.

Parameters1 field

Field	Type	Description
`id`required	string · path	—

204401403404