Skip to main content

Authentication

Every request to the eCourtDate Document Generation API is authenticated with an API key sent in the x-api-key header:

curl -s "https://api.pdfs.ecourtdate.com/v1/templates" \
  -H "x-api-key: $API_KEY"

Requests without a key are rejected with 401 MISSING_API_KEY; keys that are not set up for this API are rejected with 403 KEY_NOT_PROVISIONED (error registry).

Creating and managing keys​

API keys are created and managed in the eCourtDate Console, on the APIs page. From there you can create keys, choose their scopes, and revoke keys you no longer need.

Treat keys like passwords:

  • Store them in a secrets manager, never in source control or client-side code.
  • Use a separate key per integration so each can be rotated or revoked independently and shows up distinctly in the audit trail.
  • Grant each key the narrowest scopes that let it do its job.
  • Rotate on a schedule and immediately on suspected exposure: create the replacement key, deploy it, then revoke the old one.

Scopes​

Each key carries scopes that gate what it may call. The reference lists the required scope on every operation.

ScopeGrants
templates:readBrowse templates and versions, render previews
templates:writeCreate, edit, publish templates; manage assets
generateGenerate documents, poll jobs, fetch outputs
audit:readRead the audit trail

Calling an operation the key's scopes don't cover returns 403 INSUFFICIENT_SCOPE.

A useful property of the split: templates:read alone is enough to render previews, so an editor or browse UI can show documents without holding generation rights.

Actor attribution: X-On-Behalf-Of​

Write operations also require an X-On-Behalf-Of header naming the person the call is made for (an email or user id, 1–128 printable characters):

curl -s -X POST "https://api.pdfs.ecourtdate.com/v1/templates/$TEMPLATE_ID/versions/1/publish" \
  -H "x-api-key: $API_KEY" \
  -H "X-On-Behalf-Of: clerk@example.gov"

The value is recorded with the action in the audit trail, so agency records show who published a template or archived an asset even when all calls flow through one integration. A write without the header fails with 422 MISSING_ACTOR.

Send the identity of the human driving the action when there is one; for fully automated processes, use a stable service identity (for example nightly-notices@agency.example).

Transport​

The API is HTTPS-only. See Security for data-handling and key-hygiene guidance.