Bearer authentication
Send the workspace key in the Authorization header from server-side code only. Data Enrichment keys use the enrich_live_ or enrich_test_ prefix.
HTTP
Authorization: Bearer enrich_live_••••••••Scope by workload
| Scope | Purpose |
|---|---|
| entities:resolve | Resolve organizations and people |
| enrich:write | Submit enrichment jobs |
| jobs:read | Read job state and results |
| evidence:read | Read provenance and candidate evidence |
| graph:read | Validate and execute graph queries |
| webhooks:write | Manage signed result destinations |
Rotate without downtime
Create a replacement in the same environment, deploy it, verify successful jobs, and revoke the old key only after traffic has moved.