A valid request URL is required to generate request examples{
"publishable_key": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"key": "<string>",
"allowed_origins": [
"<string>"
],
"environment_kind": "live",
"created_at": "2023-11-07T05:31:56Z"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}Set the allowed origins
Requires api_keys:write. This list is the actual security boundary of a key that is public by design.
Matching is exact on the normalized origin — no wildcards, no prefixes. An empty list allows any origin: that is the getting-started state, and it is what you leave behind before going live.
A valid request URL is required to generate request examples{
"publishable_key": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"key": "<string>",
"allowed_origins": [
"<string>"
],
"environment_kind": "live",
"created_at": "2023-11-07T05:31:56Z"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}Authorizations
A staff session token, uk_st_…. Minted by sign-up, sign-in or the two-factor exchange. Only a 401 means it is spent; not_a_member (403) is about the organization named in X-Organization-Id and leaves the token good for the others.
Headers
The organization the caller is acting on — the org_… code that appears in the panel URL. It identifies; the membership JOIN is what authorizes, so a forged code reads nothing: the answer is not_a_member (403), which does not mean the session is over. Absent, the session's default organization answers, or — if that membership was revoked while the session was open — any other one the caller still holds.
Path Parameters
Body
Scheme and host, optionally a port. No path, no query, no fragment.
Response
Updated.
Show child attributes
Show child attributes