Every request needs a Compliance API key. An organization owner or admin creates one under Settings → Organization → API Keys → Compliance API; see Create a key.

​
Sending the key

Use either header: 
curl -H "Authorization: Bearer tgcmp_…" https://api.tigergate.dev/api/v1/compliance/whoami

curl -H "X-API-Key: tgcmp_…" https://api.tigergate.dev/api/v1/compliance/whoami
Never put the key in the URL. A request with api_key, apikey, key, token or access_token in the query string is refused with 400 credentials_in_query, whatever the value.

​
Key format

A Compliance API key is tgcmp_ followed by 72 lowercase hexadecimal characters. The last 8 characters are a checksum, so a mistyped key is rejected immediately as invalid_api_key. Other TigerGate keys are rejected with 401 wrong_key_type: Organization keys (tg_…), CI/CD keys (tgci_…) and IDE keys (tgide_…). A Compliance API key is likewise rejected by every other TigerGate API.

​
Authentication failures

StatuscodeMeaning
401missing_api_keyNo key in Authorization or X-API-Key
401wrong_key_typeThe key is a different kind of TigerGate key
401invalid_api_keyThe key is malformed or unknown in this region
401revoked_api_keyThe key was revoked
401expired_api_keyThe key passed its expiry date
403org_inactiveThe organization’s subscription is paused or has ended
403invalid_scopeThe key’s stored scope can’t be read. Edit the key in the dashboard to fix it
Revocation takes effect on the next request; keys are never cached. An invalid_api_key for a key you just created usually means the request went to the wrong region. whoami in the right region returns the key’s api_base_url. Repeated authentication failures from one IP address are throttled. See Rate limits.

​
Checking what a key can read

GET /whoami returns one entry per product the key is granted. For each product:
  • readable is true when requests for that product will succeed.
  • reason gives the error code when it is false, for example product_not_entitled when the organization’s plan no longer includes the product.
  • finding_types and resources describe the effective scope.
Run whoami when you set up an integration and whenever a product starts returning 403.