Authentication and scopes

Every request carries a bearer API key. Each key holds only the scopes you grant it.

API keys#

Send the key in the Authorization header. Keys look like rubi_live_ followed by 40 characters. The dashboard only ever shows the prefix after creation.

http

GET /v1/interviews HTTP/1.1
Host: api.rubikyt.com
Authorization: Bearer rubi_live_2b9X...

Keys can expire (expires_in_days) and can be revoked at any time. A revoked or expired key answers 401 with code unauthenticated.

Scopes#

A request without the required permission answers 403 with code forbidden. These are the scopes an API key can carry:

Scope	Allows
`interviews:read`	List interviews, read details, reports, playback and captions.
`interviews:create`	Create interviews, reissue links, retakes and share links.
`interviews:decide`	Record analyst decisions and assessments.
`interviews:delete`	Delete interviews and their media.
`traders:read`	List traders and read profiles, accounts, trades and payouts.
`traders:write`	Create and update traders, add and delete notes.
`integrations:read`	Read integration health, sync runs and egress ranges.
`integrations:manage`	Create, test, update, sync and delete integrations.
`analytics:read`	Read the analytics overview.
`webhooks:manage`	Create, update, test and delete webhook endpoints.
`audit:read`	Read the audit log.

Human only permissions

members:read, members:manage, api_keys:manage, billing:read and settings:manage exist for dashboard users only. An API key can never manage members, keys or billing.

Roles#

Dashboard users receive permissions through their role in the organization.

Role	Description
Admin	Full access: members, billing, settings, integrations and every interview.
Risk analyst	Creates interviews, reviews reports and records decisions. Manages traders.
Developer	Manages integrations, API keys and webhooks. Read access to interviews.
Viewer	Read only access to interviews, traders and analytics.

Tenancy#

A key belongs to one organization and every request is scoped to it. There is no way to read another firm's data, and the learning memory is kept per organization.