Get a Sintropix API Key for Agents and Integrations

1

Sign in and open Tu cuenta

Sign in as the User the key should act on behalf of. The key acts with that User’s Organization Memberships and their Roles, so choose a User with the access the integration actually needs.Sign-in always asks for two-step verification (Verificación en dos pasos). By default, Sintropix emails you a 6-digit code after the password. The code expires after 5 minutes. Click Enviar otro código for a new one; only the latest code works. After 5 wrong codes, you must enter your password again.Your first sign-in starts from the set-password link Sintropix emails you. Choose a password of 8 to 128 characters and click Guardar contraseña. Sintropix signs you in and emails you a code to activate two-step verification, so you type your password only once. If you sign in from the sign-in page before two-step verification is active, Sintropix emails you the code right after the password. If the link was already used or has expired, the page shows Enlace no válido. Click Pedir un enlace nuevo to ask for another one.If you forgot your password, click ¿Olvidaste tu contraseña? on the sign-in page and enter your email. If the address has a Sintropix account, you receive a link to choose a new password. The link expires after 1 hour and works once. Saving the new password signs you out of every session, then signs you in on the same page and asks for your second factor.If you prefer an authenticator app, choose Usar una aplicación de autenticación during setup. By then, Sintropix has already emailed you a code, which you can ignore. You can also switch later: click Configurar aplicación de autenticación under Tu cuenta > Seguridad. You scan a QR code, confirm a code, and save 10 backup codes. From then on, sign-in asks for the code from the app or a backup code, and Sintropix stops emailing codes. Only a session with two-step verification can create API keys.Click your name at the bottom of the left sidebar and choose Tu cuenta.

2

Go to Claves de API

Tu cuenta opens on Perfil. In the list on the left, click Claves de API. The page is at https://app.sintropix.com/account/api-keys.The page lists every key you own with its name, prefix, creation date, expiry, and last use. Keys can be revoked from the trash icon on each row.

3

Create the key

Click Crear clave. Give the key a descriptive name (for example erwin-agent or reconciliation-bot) so you can identify it later in the key list and the audit trail.If the owning User belongs to more than one Entity, the dialog also shows an Entidad legal selector. Leave it on Todas las entidades legales to let the key act across every Entity the User can already access, or pick one Entity to confine the key to that single company. A confined key cannot read or write the data of the other Entities, and the confinement is visible in the Entidad legal column of the key list.Choose one Entity when the integration only needs to work with one company (for example a bookkeeping bot that services a single client), so a leaked key cannot touch the rest.Click Crear clave in the dialog to mint the key.

4

Copy the secret

The key is shown once. Copy it with the button next to the field and store it in your secrets manager before clicking Listo. Sintropix does not display the secret again after this screen; if you lose it, revoke the key and create a new one.

5

Call the API

Send the key in the x-api-key header on every request:

curl https://api.sintropix.com/api/entities \
  -H "x-api-key: $SINTROPIX_API_KEY"

Every mutating request (POST, PUT, PATCH, DELETE) made with a key must send two extra headers:

• x-audit-actor names the software that is acting (for example my-agent).
• x-audit-reason states why the change is being made, as one line of plain text up to 500 characters.

POST /api/feedback is the one exception: it needs neither header, and a read-only key can send it too.Both values are recorded verbatim on the audit trail envelope. Omitting x-audit-actor returns 400 with code AUDIT_ACTOR_REQUIRED_ERROR. A missing or blank x-audit-reason returns 400 with code AUDIT_REASON_REQUIRED_ERROR; a value longer than 500 characters returns 400 with code AUDIT_REASON_TOO_LONG_ERROR.

curl -X POST https://api.sintropix.com/api/entities/$ENTITY_ID/partners \
  -H "x-api-key: $SINTROPIX_API_KEY" \
  -H "x-audit-actor: my-agent" \
  -H "x-audit-reason: Create Servicios Cloud SpA from the July onboarding email" \
  -H "Content-Type: application/json" \
  -d '{
    "id": "0b6c0f2e-5a4d-4e8f-b1c3-7d9e2a4f6c88",
    "name": "Servicios Cloud SpA",
    "country": "CL",
    "taxId": "76123456-0"
  }'

Requests to /api/auth/* are rejected when they carry x-api-key, so keys cannot be used to mint further keys or manage Users.Requests made with an API key do not ask for a two-step verification code. The second factor is checked once, when the key is created.

​

Scope and Permissions

• A key authenticates as its owning User, with that User’s Organization Memberships. See Access and roles.
• A key never does Superadmin work, even when a Superadmin owns it. Managing Users, Organizations, and Memberships needs a signed-in session; a key gets 403 with SUPERADMIN_SESSION_REQUIRED.
• Business routes are scoped by Entity (/api/entities/{entityId}/...). A key can only access Entities of the Organizations the owning User holds a Membership in, and only do what the User’s Role there allows. A key owned by a viewer can only read.
• A key created for a single Entity is confined to that Entity. Requests to /api/entities/{otherEntityId}/... return 404, GET /api/entities lists only the confined Entity, and GET /api/organizations returns an empty array. The key reaches the Partners of its Entity’s Organization, but it can only merge a Partner that no other Entity uses. It also reaches the Dimensions of that Organization. It lists every Integration of that Organization, never a secret, but it can’t connect, renew, or disconnect one (403 with PERMISSION_DENIED_ERROR), and it adds or removes only the feeds that land in its own Entity. Any other Organization answers 404. Routes that manage a whole Organization, such as Agent Channels, Intercompany Entries (reads included), and GET /api/organizations/{organizationId}/role, return 403. No API key can create Entities. Use one-Entity keys when the integration should only ever touch one company.

​

Rate Limits

​

Rotation and Revocation

• Rotate keys on a schedule and whenever a team member with access leaves.
• Revoke a key immediately from Tu cuenta → Claves de API if you suspect it has leaked. Revocation takes effect on the next request.
• Every action taken with a key is recorded in the audit trail under the owning User, so leaked-key activity is traceable.