Core concepts
Request headers
Four headers you send, two you get back, and what each of them settles.
What you send
| Header | When | What it does |
|---|---|---|
Droomwork-Api-Key | Every request, unless you use a token | Your credential, and where your organisation comes from |
Authorization: Bearer | Instead of a key | The same, from the client credentials grant |
Idempotency-Key | Anything that changes data | Makes a retry safe. See the idempotency guide |
Content-Type: application/json | Any request with a body | Every body you send is JSON |
What you get back
| Header | Meaning |
|---|---|
Droomwork-Request-Id | This request, on every response including refusals. Quote it when you ask us about one |
Droomwork-Idempotent-Replay | Present and true when the response is a replay of an earlier identical request rather than new work |
One request identifier reaches every audit entry and every event that request produced. It's the fastest thing to give us.
From a browser
The API answers cross origin requests and permits exactly the four headers above. It doesn't read cookies and doesn't set any, so there's nothing for your browser to send by accident.
Sending a live key from a browser exposes it to everyone who loads the page. Keep keys on a server.