API keys

API Keys let integrators call the CaseWizard REST API with X-Api-Key authentication. Use a separate key for each integration so you can scope, rotate, and revoke access independently.

Create an API key

The secret is shown only once at creation. If you lose it, create a replacement key rather than expecting the existing secret to be displayed again.

Choose scopes

Third-party scopes mirror API areas. Available areas include cases, people, documents, calendar, billing, reports, and webhooks, along with other API areas. Scopes provide read and/or write access according to the selected capability.

Give an integration the smallest set of scopes that supports its job. A reporting integration may need read access, while a synchronization process may need write access for the resources it updates. Do not grant broad write access when narrower access is sufficient.

Rotate or revoke a key

Rotate a key when an integration's secret may have been exposed, when staff responsible for it change, or when your firm's security process requires regular rotation. Update the integration with the replacement before revoking the old key if you need to avoid an interruption.

Revoke keys when an integration is retired, a vendor relationship ends, or the key is no longer needed. Keep a record of the integration name, owner, scopes, and rotation date so administrators can review the key list confidently.

Test API access

After creating a key, use it only from the intended integration or an approved API client. Send the key using the X-Api-Key authentication mechanism. Confirm that the integration can perform its required operations and that requests outside its scopes are not part of its design.

Interactive API documentation is available at api.staging.casewizard.com/docs. Use Developers for additional API and MCP information.

Next steps