VeritomeHelp Centre
/
Browse documentation
Integrations

API keys and organisation data export

Create hashed, scoped API keys for programmatic access, generate a sealed export of all organisation data, and file a GDPR erasure request.

Updated Veritome documentation

API keys

API keys give scripts, pipelines and AI assistants programmatic access to the v1 API and the MCP server (see Machine API and the MCP server). API access is a Manage-plan feature, and requests are rate-limited per key.

  1. Go to Organisation → API keys & webhooks and create a key with a name and a scope — read-only or read & write. A read-only key is rejected on any mutating endpoint; a supplied scope is honoured exactly, so an integration that asked for read-only never receives mutating credentials by default.
  2. The full key (starting with ak_) is shown exactly once. Only a SHA-256 hash is stored at rest, so copy it before closing the dialog.
  3. Send it as a bearer token in the Authorization header.

Only an Admin can mint a key. You can rotate a key (a new secret, same entry) or revoke it from the same list, which also shows each key's prefix and last-used time. Creation, rotation and revocation are all audit-logged.

Export all data

From Organisation → Data, privacy & residency, an Admin can click Generate export to download a complete machine-readable bundle of the organisation's data — systems, classifications, obligations, incidents and the audit trail. The bundle is built server-side, stored in object storage, and returned as a short-lived signed download link together with a SHA-256 fingerprint so recipients can verify the bundle was not altered after generation. This supports GDPR Art. 15 access requests and Art. 20 portability.

Delete organisation (GDPR erasure)

On the same page, Delete organisation files a GDPR Art. 17 right-to-erasure request rather than deleting inline: type your organisation's exact name to confirm, and the page then shows Erasure request pending with the filing date and the one-month due date GDPR Art. 12(3) sets for acting on a request. The Veritome operator fulfils the request on an audited path; contact support to cancel while it is pending.