Skip to content

OAS Spec

eXate exposes two REST APIs. The Execution API is what your applications call at runtime to protect and unprotect data, this is the one most integrations use. The Management API configures the objects that govern that protection: Manifests, Attributes, and Policies. Most teams script Manifest and Policy setup through the Management API once, then call the Execution API continuously from application code.

This page covers getting access, authenticating, and testing before you write any integration code. For architecture-level guidance on wiring eXate into a specific gateway or service, see the guides linked at the bottom of this page.

Getting access

  1. Register on the Developer Portal. See How to Access the Portal, you'll sign up at developer.exate.co and receive credentials by email.
  2. Create an Application and subscribe to an API plan. See Create an Application. For evaluation, subscribe to the free eXateTrialAccess plan against the APIgator source API.
  3. Procure your API Key. See Procure your API Key. Your key is a GUID, found under your Application's Subscriptions tab, copy it from there.

If you're on the SaaS Sandbox, these three steps are exactly the same, sandbox and production both run through the same Developer Portal, just with separate credentials and plans.

Authenticating

The API is secured by an OAuth Bearer token, not the API Key directly, the API Key identifies your subscription; the Bearer token authorises the call.

  1. Obtain a token from the eXate auth endpoint using your API Key.
  2. Cache the token, it's valid for roughly 10 minutes.
  3. Reuse the cached token for subsequent calls until it expires, then refresh it. Requesting a new token on every call adds unnecessary latency.

Include the token as an Authorization: Bearer <token> header on every Execution or Management API request.

Testing with Postman

  1. Import the OAS spec directly into Postman: choose the required API version and API type below, then use the corresponding oas/public/<version>/public-<api>.json file from this site (right-click either link and copy the URL, or download and import the file).
  2. Set up a Postman environment with two variables: apiKey and bearerToken.
  3. Add a request to the auth endpoint that returns your Bearer token, and use a Postman Tests script to save the response token into your bearerToken environment variable automatically, so you don't have to copy it manually between requests.
  4. On your Protect/Unprotect requests, set the Authorization header to Bearer {{bearerToken}}.
  5. Send a request with a small sample payload first to confirm authentication works before testing a real payload.

Or start from a ready-made collection: download the eXate API Guide Postman collection. It walks through tenancy creation, the system configuration for adjusting how protected values are formatted, Policy and Manifest setup through the Management API, and a working Protect call through the Execution API, in order, with token capture already scripted between requests. Replace every CHANGE_ME variable with your own values before running it.

Execution API vs Management API

  • Execution API: called at runtime. Send a payload plus context (identity claims, source system, purpose of use), get back a transformed payload, masked, tokenised, encrypted, or filtered according to your Policies.
  • Management API: called during setup or when configuration changes. Used to create and update Manifests, Attributes, and Policies programmatically instead of through the portal UI.

Guides

Deeper, task-specific guidance for building against these APIs: REST/gRPC endpoints, driver installation, and headless configuration.

For browser-based, portal UI workflows instead of direct API calls, see Platform, starting with Manifests, including the Bulk ETL Walkthrough for bulk/ETL protection through the portal.