Skip to main content

CaseBender Endpoints

View the OpenAPI specification file

​
Authentication

All API endpoints require authentication using API keys. You must include both headers in every API request:
  • x-api-key: Your Access Key (public identifier)
  • x-api-secret: Your Secret Key (private authentication token)
Important: Both headers are required. If either header is missing or incorrect, you will receive a 401 Unauthorized error.

​
Creating API Keys

To create API keys:
  1. Log in to your CaseBender instance
  2. Navigate to Account Settings → API Keys
  3. Click Create to generate a new API key pair
  4. Save both keys immediately - the Secret Key is displayed only once and cannot be retrieved later
When you create an API key pair, you’ll receive:
  • Access Key: A public identifier that can be viewed later
  • Secret Key: A private token shown only once - if lost, you must create a new key pair

​
Using API Keys

Include both headers in all API requests:

​
Using cURL

curl -X GET https://your-instance.casebender.com/api/alerts \
  -H "x-api-key: YOUR_ACCESS_KEY_HERE" \
  -H "x-api-secret: YOUR_SECRET_KEY_HERE" \
  -H "Content-Type: application/json"

​
Using Python (requests library)

import requests

headers = {
    "x-api-key": "YOUR_ACCESS_KEY_HERE",
    "x-api-secret": "YOUR_SECRET_KEY_HERE",
    "Content-Type": "application/json"
}

response = requests.get(
    "https://your-instance.casebender.com/api/alerts",
    headers=headers
)

​
Using JavaScript/Node.js (fetch)

const response = await fetch(
  "https://your-instance.casebender.com/api/alerts",
  {
    method: "GET",
    headers: {
      "x-api-key": "YOUR_ACCESS_KEY_HERE",
      "x-api-secret": "YOUR_SECRET_KEY_HERE",
      "Content-Type": "application/json",
    },
  }
);

​
Common Authentication Errors

  • 401 Unauthorized:
    • Missing x-api-key header
    • Missing x-api-secret header
    • Incorrect key values
    • API key has expired (if expiration was set)
    • API key has been revoked
  • Troubleshooting:
    • Verify both headers are included and spelled correctly (case-sensitive)
    • Ensure there are no extra spaces or line breaks in the key values
    • Check that your API key hasn’t expired or been revoked
    • Create a new API key pair if you’ve lost your Secret Key

​
Security Best Practices

  • Never share your Secret Key - treat it like a password
  • Rotate API keys regularly - revoke old keys and create new ones periodically
  • Use different keys for different applications - this allows you to revoke access per application
  • Set expiration dates - configure API keys to expire automatically when possible