API access and authentication

The public REST API allows authorized clients to work with a personal or team workspace. Access must be enabled for the intended workspace; seeing a feature in this reference does not grant access to it.

Base URL: https://api.corpdev.ai/v1/public

The examples use placeholder identifiers and an API key supplied through the environment. Run initial writes in a designated test workspace with synthetic data.

Create and protect a key

Use the account's API keys controls when available. Choose the intended personal or team workspace, label the key, select the required scopes and set an expiry where offered. Copy the secret when it is created; it is shown once.

Store it in a secret store or protected runtime environment. Do not commit it, put it in client-side browser code or send it in a URL. Use the authorization header:

Authorization: Bearer cdk_YOUR_SECRET_KEY

The key fixes the workspace. An X-Base-Path header is not a way to select another tenant. Use a separately authorized key for a different workspace.

Scopes and roles

Scope	Purpose
read	Permitted reads and supported research operations. Some of these operations use credits.
write	Permitted mutations and generation, also subject to the key owner's role.
export	Supported document exports.

Scopes and workspace permissions both apply. A read key does not override restricted folders or viewer restrictions. Some collection reads require a role allowed to work with that collection. Request only the scopes your client needs.

Keys can stop working because they expire, are revoked, lose valid membership, or the workspace's API access is suspended. An enabled key is not a permanent entitlement independent of these checks.

Suspend or revoke access

Workspace administrators can use Workspace → API & MCP access, when enabled, to inspect keys and suspend programmatic access. Suspension is distinct from permanent key revocation. Resume access through the available control after resolving the reason for suspension.

If the page says access is turned off by CorpDev.Ai, contact your representative; that restriction cannot be lifted by a workspace administrator alone.

Before revoking a key, identify the client using it. Replace the credential in that client if it should continue operating. A leaked key should be revoked promptly.

Continue with REST quick start, API behavior and MCP clients.