Creating a key
- 1Open Settings, then API keys. Only owners and admins see this screen.
- 2Give the key a name that says where it runs, for example "listing pipeline, production".
- 3Pick the scopes it needs and create it.
- 4Copy the key immediately. Only a short prefix is stored afterwards — the full value is never shown again.
| Scope | Grants |
|---|---|
| jobs:read | Read inspections, findings, outputs and reports. |
| jobs:write | Create inspections, apply fixes, request re-inspection. |
| rules:read | Read the resolved marketplace ruleset. |
Grant only what the integration needs. A read-only reporting job should never hold jobs:write.
Authenticating
Send the key as a bearer token on every request. Keys look like dk_live_ followed by a random secret.
curl -H "Authorization: Bearer dk_live_..." \
"https://dodam.vanillax.co/api/v1/rules?country=JP&platform=rakuten"A missing or invalid key returns 401 unauthorized. A valid key without the required scope returns 403 forbidden and names the scope it needs.
The endpoints you will use most
| Call | Purpose |
|---|---|
| POST /api/v1/jobs | Create an inspection from a multipart upload of images and listing text. |
| GET /api/v1/jobs/{id} | Read the job with its score, verdict and summary. |
| GET /api/v1/jobs/{id}/findings | List findings with evidence, severity and auto-fix flags. |
| POST /api/v1/jobs/{id}/fix | Apply a list of finding ids; re-inspection runs automatically. |
| POST /api/v1/jobs/{id}/reinspect | Start a new round without applying fixes. |
| GET /api/v1/jobs/{id}/outputs | Final asset URLs, or add format=zip for the archive. |
| GET /api/v1/jobs/{id}/report | The full report as JSON. |
| GET /api/v1/usage | Units used this month against your quota. |
The full reference, request bodies and response shapes are in the API documentation, and the machine-readable contract is at /api/v1/openapi.json.
Error codes
Errors always return the shape { error: { code, message } } so you can branch on code rather than on a message string.
| Status | Code | Meaning |
|---|---|---|
| 400 | validation_error | A field is missing or has an unknown value; the message names it. |
| 401 | unauthorized | No key, a revoked key, or a malformed header. |
| 403 | forbidden | The key lacks the scope, or the resource belongs to another organization. |
| 404 | not_found | No such job in your organization. |
| 415 | unsupported_media_type | The upload was not multipart or the file type is not an image. |
| 429 | quota_exhausted | The monthly quota is used up. |
| 500 | internal_error | Unexpected failure — retry, then contact support with the timestamp. |
Rotating and revoking
- 1Create the replacement key first and deploy it.
- 2Confirm the new key is being used — the API keys screen shows the last-used time for each key.
- 3Revoke the old key. Revocation takes effect on the next request and cannot be undone.
If a key has leaked, revoke it first and worry about the deployment second. Every call made with a key is attributed to it in your usage breakdown.
Was this helpful?
Related guides
- Usage and monthly quotaWhat counts as a unit, where to see the remaining balance, and what happens when the quota runs out.
- Team members and rolesInvite colleagues, choose the right role, and understand what each role can and cannot do.
- Final assets and the inspection reportWhat you get at the end of a job, how versions are tracked, and what is inside the report.
Did not find the answer?
Send us the question with your inspection id and we will look at the exact job.