API keys

An API key lets one of your other systems use the InTouch API on your organisation’s behalf. Each request carries the key in its x-intouch-o-token header.

Create a separate key for each integration. Actions taken with a key are recorded under its name, and you can remove one integration’s access without affecting the others.

To manage API keys, a member of staff needs the Can edit API keys permission.

Creating a key

1. Navigate to Settings > API and open Keys
2. Select Add New Key
3. Enter a Name that identifies the integration, using only letters, numbers, spaces and full stops
4. Tick the permissions the key needs:
   • Read: the endpoints that list and read data
   • Write: the endpoints that change data
   • Delete: moving a file, email, note, phone call or SMS on a matter to the trash, where staff can restore it. A key can only trash notes and phone calls that were created through the API. Delete is off unless you tick it, and needs Write as well
5. Select Create New Key

The key appears in the list, hidden. Select the eye icon to reveal it, and select the key to copy it.

Give each key only the permissions its integration needs. A request the key does not have permission for is refused with 403 Forbidden.

Changing a key

Select Edit beside a key to change its name or permissions, then select Update Key. Changing the permissions of a key that is in use may break the integration using it.

Removing a key

Select Remove beside a key, then type the key’s name to confirm. Any integration still using it stops working straight away.