API Keys
Manage your API keys.
Our APIs can be used for integrations with third-party services. Each endpoint requires proper authentication and authorization through an API key included in the request header.
To access and manage your API keys, navigate to Settings in the left-hand menu and select the API Keys tile. The page has two tabs: API Keys, where keys are created and revoked, and Call Log, where you can review the calls made with them.
You can add keys by clicking the + Create new API Key button. When creating new keys, you’ll be asked to name them. This will help you track what a given key is being used for, which is helpful when revoking keys later.
You can revoke API keys by clicking their checkboxes which will reveal a top menu with a Delete option.
The Call Log tab lists the API calls made with your organization’s keys — what was called, with which key, and how it went. Use it to confirm an integration is reaching Xyte, to see which key a script is using, or to find the failing call behind an error.
| Column | What it shows |
|---|---|
| Date | When the call reached Xyte. |
| API Key | The name of the key used. The name is recorded with the call, so the log stays readable after a key is deleted. |
| Call | The HTTP method and the path that was called. |
| Params | The query and body parameters sent. Hover a row to see the full payload. Sensitive values such as passwords and tokens are stored as [FILTERED], and unusually large payloads are not kept — those rows show Payload too large to store. |
| Origin | CLI for calls made by the Xyte CLI, Direct for everything else — your own scripts, integrations, or a tool such as Postman. Hover the badge for the exact client and version. |
| Status | The HTTP status returned. Green is a success, orange a client error (4xx), red a server error (5xx). |
| Duration | How long the call took to process, in milliseconds. |
Newest calls are listed first. Every column except Params can be sorted and filtered, so you can narrow the list down to a single key, a path, a status code, or a date range.
What the Call Log does not includeOnly authenticated calls are recorded. A call rejected because the API key was missing, invalid, or revoked does not appear, since it cannot be attributed to your organization. Actions taken by users in the portal are not API calls and are not listed here either — see Audit Logs for those.
Viewing the Call Log requires organization admin access.
Updated 8 days ago