Authentication
Create an API key and send it with every call.
Create a key
Settings, then API keys. Admins create keys. Members can see them and their usage.
| Field | |
|---|---|
| Name | Which system uses it ("Nightly CRM sync"), so you know what stops if you revoke it |
| Expires | Never, 30 days, 90 days or 1 year (default). An expired key is refused |
| Only from these IP addresses | Optional: the caller's addresses or networks (203.0.113.10, 198.51.100.0/24, IPv6 too). Calls from anywhere else get 403 IP_NOT_ALLOWED |
| Access | Read only (consent:read): consent records, consent state, purposes, collection points. Read and record consent (consent:read and consent:write): also recording consent and portal sessions. Log deletions (retention:write): also logging deletions |
- Shown once. The key (
pb_live_and 43 characters) appears once, when created. Pactbase stores only its SHA-256, so a lost key cannot be recovered. Revoke it and create another. - Telling keys apart. The list shows each key's first characters, its status (Active, Expired or Revoked), who created it, and when and from which IP it was last used.
- Revoking stops the key immediately. It stays in the list, with its usage, for the audit trail.
- Audit log. Creating, changing and revoking keys are recorded.
Send the key
Authorization: Bearer pb_live_...or X-API-Key: pb_live_.... The organisation is always the key's own. There is no org_id parameter, and a key can never read another organisation.
Keep keys on your server. Never put one in a web page or a mobile app.
Rate limit
60 calls per minute per key by default. Over it, the answer is 429 RATE_LIMITED. Wait a minute.
API explorer
Settings, then API keys, then API explorer builds the curl command for any request, so you copy a working command instead of assembling one:
- Pick the endpoint, and fill every parameter as a form field: period or exact IST dates, email or subject id, form, purpose and website dropdowns with your own values, source, granted or refused, order, limit and cursor.
- The command updates as you change fields, with a Copy button.
- Warnings show what the API would refuse: a missing email for consent state, "from" after "to", a limit outside 1 to 1000.
- The command shows
pb_live_YOUR_KEYunless you paste a key. A pasted key stays in that browser tab, and nothing is sent from the page.
Usage log
Every call made with a key is written to an audit log: who fetched what, when, from where, with which filters, and how many records came back. Refused calls are logged too. Settings, then API keys, then Usage shows the last 100 calls per key. Rows are kept for a year.
A call with an unknown or malformed key has no organisation to log it under, so it does not appear there.