Authentication

The Prosli API will authenticate with organization-scoped API keys, sent as a bearer token.

API keys

Keys are issued per organization and carry that organization's permissions. A key never spans organizations. Treat keys like passwords: keep them server-side and rotate them if exposed.

Making a request

curl https://api.prosliai.xyz/v1/organizations/current \
  -H "Authorization: Bearer $PROSLI_API_KEY"

Scopes

Keys will be scoped to least privilege — for example, a read-only key for reporting versus a key that can advance candidates. Scope names will be documented alongside each endpoint.

Errors

• 401 Unauthorized — the key is missing or invalid.
• 403 Forbidden — the key is valid but lacks access to the resource.