Authentication
All API requests require authentication using API keys. Each key is scoped to a specific organization and has configurable permissions.
API Key Headers
Include these headers with every request:
| Header | Description |
|---|---|
api-key | Your API key (starts with fob_stm_) |
api-secret | Your API secret |
Example
curl -X GET "https://statements.finopsbricks.com/api/v1/transactions" \
-H "api-key: fob_stm_xxxxxxxxxxxx" \
-H "api-secret: xxxxxxxxxxxxxxxx"
Creating API Keys
- Navigate to Settings - API Keys in your organization
- Click Create new API Key
- Enter a name for the key
- Select a permission preset or customize permissions
- Optionally set an expiry date
- Copy and securely store the secret (shown only once)
Permission Presets
| Preset | Description |
|---|---|
| Full Access | Read and write access to all resources |
| Read Only | Read-only access to all resources |
| Transactions Only | Full access to transactions, read-only for others |
| Custom | Define your own permission matrix |
Permission Matrix
Permissions are defined as a matrix of resources and actions:
| Resource | read | create | edit | delete |
|---|---|---|---|---|
| transactions | Yes/No | Yes/No | Yes/No | Yes/No |
| accounts | Yes/No | Yes/No | Yes/No | Yes/No |
| statements | Yes/No | Yes/No | Yes/No | Yes/No |
| rules | Yes/No | Yes/No | Yes/No | Yes/No |
Error Responses
Missing Credentials
{
"error": {
"code": "UNAUTHORIZED",
"message": "Missing API credentials"
}
}
Invalid Credentials
{
"error": {
"code": "UNAUTHORIZED",
"message": "Invalid API credentials"
}
}
Expired Key
{
"error": {
"code": "UNAUTHORIZED",
"message": "API key expired"
}
}
Insufficient Permissions
{
"error": {
"code": "FORBIDDEN",
"message": "API key lacks transactions:create permission"
}
}
Security: Never expose your API secret in client-side code or public repositories. The secret is shown only once when creating the key.