Skip to content

Authentication and access

Authentication

API requests use an API key from your account page on quicklookup.com (or audvitad.snjallgogn.is), sent as a bearer token to https://quicklookup.com/api/v1/…:

Authorization: Bearer <your API key>

A key belongs to your company. Its plan sets how many requests a minute it may make and how far back and ahead it may read. The docs workbench and API explorer keep the key in sessionStorage; closing the tab removes it. They do not write it to local storage or send it to another origin.

The admin uses the active WorkOS organization. If the wrong organization is active, sign out and choose the correct one before editing.

Account assignment

QuickLookup derives the customer account from signed identity claims. Provisioning and ingestion requests contain business data only. A request cannot choose or override the account that owns the definition or rows.

The server also supplies these values from the accepted publication where applicable:

  • access policy;
  • provenance;
  • service and collection identity;
  • catalogue revision;
  • time grain.

Saved-context requests select account or personal scope. The server derives the active account or personal owner from verified claims; clients cannot submit either owner. Account context is readable by the account and writable by editors. Personal context is visible and writable only by its owner. Resolving context reapplies current catalogue and row access, so a saved selection can never preserve access that has been revoked.

Roles

Role Permissions
viewer Discover, inspect, and query entitled services.
editor Viewer permissions plus draft creation and stored-row ingestion for the active account.
publisher Editor permissions plus publish and archive.
operator Publication recovery and other restricted operations.

The API explorer loads a role-scoped OpenAPI document. Operations the token cannot execute are omitted from the explorer. Server-side authorization still runs on every request.

Privacy and sharing

Access policy Use it for
Local Data private to the owning customer account.
Exclusive Data shared with named entitled customers.
Group Data shared with an entitled customer group.
SharedPercentiles Governed percentile outputs.
SharedObfuscated Governed obfuscated outputs.
Shared Shared values for entitled consumers.
Public Data available to authorized consumers.

An access policy describes how a service may be shared; it does not grant access by itself. The consumer must also have a matching catalogue grant. QuickLookup returns 404 for an unknown service and for a service the caller cannot see, so the response does not disclose which case applies.

Before publishing shared data

  • Confirm that the selected policy matches the intended audience.
  • Check that fields and metrics do not expose more detail than the policy permits.
  • Test with an entitled token and with a token that must not have access.
  • Publish a new revision when the contract or policy changes; do not edit a delivered snapshot.