Authentication

All endpoints described in this document require API key authentication.

API access is enabled per company on request — ask your Sitemark contact, or see API access in the help center. Once it is enabled, a user who can manage users creates the key in the Sitemark web app under Settings > Integrations > API.

Include your API key in the Authorization header using the ApiKey scheme:

Authorization: ApiKey <your-api-key>

If the API key is missing, invalid, revoked or expired, you will receive a 401 Unauthorized error.

What a key can do

A key gets a copy of the company-wide rights given directly to the person who creates it. Rights the person has through a group are not copied. Access to sites is copied the same way: the key only reaches the sites given to that person directly, or all sites if the person has access to all sites. Data on any other site is not visible to the key: lists leave it out, and requests for a single item there return 404.

A key is not a person, so rights that depend on the person (for example “tickets assigned to me”) never apply to it.

Key expiry

API keys expire one year after they are created. Create a new key before the old one expires, and update your integration to use it.

Best practices

• Use one key per integration, so you can revoke one without stopping the others.
• Name each key after its integration, for example “VCOM Integration”.
• If a key may have leaked, revoke it in Settings > Integrations > API and create a new one.