Keys and scopes
Send Authorization: Bearer nrx_… with every request.
API keys
Keys are created by Admins in Settings → API keys and shown once; NORYX stores only their SHA-256 hash. A key acts for the Admin who created it: if that person stops being an active Admin, the key stops working until they are an Admin again. Keys expire (90 days by default, up to two years), can be revoked at once, record when they were last used, and have their own per-minute limit (120 by default).
Every call with a key is written to the organisation’s audit log with the key as the actor. A key reaches only the public operations below; members, settings, approvals, autonomy and the keys themselves need a person signed in.
Scopes
A key holds one or more scopes, never more than its Admin’s role allows.
| Scope | Allows | Operations |
|---|---|---|
| records:read | Read accounts, people, deals, activity, signals, evidence, decisions and memory | 24 |
| records:write | Create and update accounts, people, deals, interactions and evidence | 9 |
| intelligence:run | Start intelligence runs (research, briefs, next best actions) | 1 |
| team_insights:read | Read the forecast and the Command Center | 2 |
Rate limits and errors
Each key has a token bucket: its per-minute limit, refilled over 60 seconds, shared by every API server. Every response carries X-RateLimit-Limit; over the limit you get 429 with Retry-After (seconds), before the request runs, so it is always safe to retry.
Errors have one shape: { "error": { "code", "message", "details", "requestId", "traceId" } }. Codes are stable: unauthenticated (401: missing, revoked, expired or inactive key), forbidden (403: details.reason is api_key_scope when the key lacks the scope), not_found, validation_failed, conflict, rate_limited. Quote the requestId when you contact support.