API Reference · Introduction

Authentication

Every API request is authenticated with an API key that belongs to your company. The key decides which company's data you see and whether you may change anything.

Get a key

The company owner or an admin creates keys in the dashboard under System Settings → API Keys (see Create an API key). The full key is shown once, when it's created. Keys can't be created or revoked over the API.

Keys look like this — the start tells you what kind of key it is:

Key types

vk_live_…Full access

Can read and change everything the API offers.

vk_test_…Read-only

Can only make GET requests. Anything else is refused with 403. It reads your real data — it is not a sandbox.

Send the key

Put the key in the Authorization header as a bearer token:

Authorization header

curl https://calling.ubiqproject.com/api/v1/campaigns \
  -H "Authorization: Bearer vk_live_YOUR_KEY"

Or, if your tool can't set an Authorization header, use X-API-Key:

X-API-Key header

curl https://calling.ubiqproject.com/api/v1/campaigns \
  -H "X-API-Key: vk_live_YOUR_KEY"

If you send both, X-API-Key wins. A bearer token is only treated as an API key when it starts with vk_.

Check a key

Call GET /whoami to confirm a key works and see whether it is full access or read-only.

When authentication fails

Responses

Invalid API key401

The key is wrong, or it has been revoked.

Not authenticated401

No key was sent — or the Authorization header isn't Bearer vk_….

This API key is read-only403

A vk_test_ key was used for a POST, PATCH or DELETE.

Response · 401

{ "detail": "Invalid API key" }

Keep keys safe

A key acts for your whole company. Use it from your server, never from a browser or a mobile app.
Give each system its own key, so you can revoke one without breaking the others.
Use a read-only key for anything that only reports on results.
If a key leaks, revoke it in API Keys straight away — it stops working on the next request.

Keys act as an admin

A full-access key can do everything an admin can do through the API, including removing phone numbers and deleting campaigns.