Authentication

Every request is authenticated with an organisation API key. Keys are created in the dashboard under Organization → API and are shown once, at creation time — store them in a secret manager.

amrg_live_9f2c…  (prefix + 48 hex characters)

Only a SHA-256 hash of the key is stored server-side; the prefix shown in the dashboard is for identification only.

Sending the key

Pass the key in the Authorization header (preferred) or X-Api-Key:

curl https://app.amoreg.com/api/v1/credits \
  -H "Authorization: Bearer $AMOREG_API_KEY"

curl https://app.amoreg.com/api/v1/credits \
  -H "X-Api-Key: $AMOREG_API_KEY"

Scopes

Keys carry scopes limiting what they can call — pick them when creating the key in the dashboard:

Scope	Grants
`search`	`POST /search`, `GET /jurisdictions`
`screenings`	`POST /screenings`, `GET /screenings/{id}`, `GET /jurisdictions`
`credits`	`GET /credits`, `GET /credits/ledger`, `POST /top-ups`
`documents`	`GET/POST /documents`, `GET/DELETE /documents/{id}`
`executions`	`POST /executions`, `GET /executions/{id}`

A key missing the required scope receives 403 Forbidden. Keys created before the documents/executions scopes existed do not gain them automatically — create a new key to use those surfaces.

Errors

Status	Meaning
`401`	Missing, malformed, or revoked key
`402`	Insufficient prepaid credit — top up and retry
`403`	Key lacks the required scope
`429`	Slow down (reserved for future rate limits)

Revoking a key in the dashboard takes effect immediately; in-flight screening runs started by that key still settle normally.

Getting started

Integrations

Authentication

Sending the key

Scopes

Errors

​Sending the key

​Scopes

​Errors

Sending the key

Scopes

Errors