Hermeticor API

Authenticate with a secret key: Authorization: Bearer hmsk....

Embed
Preview of the card
<a href="https://hermeticor.com/docs/ref-hermeticor-api"><img src="https://hermeticor.com/docs/_api/public/orgs/5fcd8b3c-a27c-4688-972f-de710125592f/spaces/caf5dc05-15f7-4e0c-bdb8-ab29ede6211e/pages/8a330c86-69e1-42a8-97fc-4b65326a29fe/social-card.svg?v=3e7ae33eec8b" alt="Hermeticor API" width="600" height="315"></a>

Hermeticor API

Authenticate with a secret key: Authorization: Bearer hm_sk_.... Keys carry scopes; a missing scope returns 403. Operations secured by the session scheme (agency, key management and other dashboard-only routes) need a signed-in web session; a key gets 403.

Send Idempotency-Key (1-255 characters) on any POST, PATCH or DELETE: for 24 hours a retry with the same key and the same request returns the original status and body (header Idempotent-Replayed: true) without repeating the action; the same key with a different request returns 422 idempotency_key_reused. Keys are scoped to the API key or user. Failed requests are not stored, so retrying them runs again.

Request bodies are strict for API keys: an unknown field returns 400 naming it (details.unknownFields) instead of being ignored.

Pin behaviour with the Hermetica-Version request header (default: the version in info.version). Breaking changes ship under a new version string and are listed in the changelog.

Each API key is limited to 1,200 requests a minute unless the key sets its own limit; keyed responses carry RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset, and 429 adds Retry-After. Every list route returns { items, nextCursor } and takes limit (1-200) and cursor (the opaque nextCursor of the previous page; null means the last page). Lists with no stated default return everything when limit is omitted. The one exception is the Zapier/Make trigger sample, which is a bare array as those tools expect.

Authentication

Each operation names the schemes it accepts; the code samples carry the first one. An operation that takes none says so.

  • apiKey — HTTP bearer: send Authorization: Bearer <token>. Secret API key (hm_sk_...)

  • session — API key in the hm_session cookie. Signed-in web session only: API keys get 403

Updated