Introduction

​

Authentication

​

Recommended: Bearer Token

Authorization: Bearer cbr_live_your_api_key_here

​

Alternative: X-Api-Key Header

X-Api-Key: cbr_live_your_api_key_here

​

Creating API Keys

1. Log in to your CaseBender instance
2. Navigate to Account → API Keys
3. Click Create API Key
4. Configure the key name, description, tier, and scopes
5. Save the key immediately - it is displayed only once and cannot be retrieved later

cbr_live_a1b2c3d4e5f6g7h8i9j0...

​

Using API Keys

​

Using cURL

curl -X GET https://your-instance.casebender.com/api/v1/alerts \
  -H "Authorization: Bearer YOUR_API_KEY_HERE" \
  -H "Content-Type: application/json"

​

Using Python (requests library)

import requests

headers = {
    "Authorization": "Bearer YOUR_API_KEY_HERE",
    "Content-Type": "application/json"
}

response = requests.get(
    "https://your-instance.casebender.com/api/v1/alerts",
    headers=headers
)

​

Using JavaScript/Node.js (fetch)

const response = await fetch(
  "https://your-instance.casebender.com/api/v1/alerts",
  {
    method: "GET",
    headers: {
      "Authorization": "Bearer YOUR_API_KEY_HERE",
      "Content-Type": "application/json",
    },
  }
);

​

API Key Tiers

​

API Key Scopes

• alerts:read - Read alerts
• alerts:write - Create and update alerts
• cases:read - Read cases
• cases:write - Create and update cases
• observables:read - Read observables
• observables:write - Create and update observables
• users:read - Read user information
• Administrative scopes are shown only when the key manager already possesses the corresponding permission

​

Common Authentication Errors

• 401 Unauthorized:
  • Missing Authorization header
  • Invalid or expired API key
  • API key has been revoked or suspended
  • API key owner has been disabled, locked, or deleted
• 403 Forbidden:
  • API key lacks required scope for the operation
  • Organization, team, parent-object, or TLP access restrictions
• 429 Too Many Requests:
  • Rate limit exceeded for your tier

​

Security Best Practices

• Never share your API key - treat it like a password
• Rotate API keys regularly - revoke old keys and create new ones periodically
• Use different keys for different applications - this allows you to revoke access per application
• Set expiration dates - configure API keys to expire automatically when possible
• Use minimum required scopes - only grant the permissions your application needs