Authentication

API keys

Generate a key from Settings → API keys. The raw key (notra_live_...) is shown exactly once — only its SHA-256 hash is stored. Losing it means generating a new one; there's no way to retrieve an old key's value.

Requires an API-access plan (Pro, Agency, or Enterprise) and org owner/admin to create or revoke a key.

Making a request

Every /api/v1/* request needs a Bearer token:

curl https://your-notra-domain/api/v1/scans \
  -H "Authorization: Bearer notra_live_..."

A key is scoped to the organization that created it — every endpoint only ever sees that org's scans. A scan belonging to another org 404s exactly like one that doesn't exist, never a 403 that would confirm the id is real.

Revoking a key

Revoke any time from Settings. Requests using a revoked key fail immediately with 401.

Rate limits

60 requests/minute per key, plus the same per-org scan-concurrency and scans-per-hour caps every scan goes through regardless of how it was started. A 429 response includes a retry-after header.