Authentication¶

All requests to the Djinn API must be authenticated with an API key.

Mechanism — X-API-Key¶

Include your API key in the X-API-Key header of every request:

curl -H "X-API-Key: your_api_key" \
     https://api.djinn.solyntek.io/v1/extract

API keys are issued by the Solyntek team during onboarding. They cannot be self-provisioned via the API.

Tenant Isolation¶

Each API key is associated with a single tenant. All your data, knowledge bases and audit logs are strictly isolated from other tenants. It is not possible to access another tenant's data, even with a valid key.

Rate Limiting¶

Requests are limited per API key. If the limit is exceeded, the API returns a 429 error. Exact limits are communicated during onboarding and are listed in your service agreement.

When you are approaching the limit, an X-RateLimit-Remaining header is included in the responses.

Error Codes¶

HTTP Code	Meaning
`401 Unauthorized`	Missing or invalid API key
`403 Forbidden`	Valid API key but access denied to this resource
`429 Too Many Requests`	Rate limit reached — wait before retrying

Example 401 Response¶

{
  "error": "unauthorized",
  "message": "No API key provided or API key is invalid"
}

Example 429 Response¶

{
  "error": "rate_limit_exceeded",
  "message": "You have exceeded your rate limit",
  "retry_after": 60
}

Best Practices¶

Never expose your API key in versioned source code — use environment variables
Rotate your staging and production keys separately
Contact Solyntek immediately if you suspect a key has been compromised