Graph Swiss API uses a single API key passed as an HTTP header. There are no OAuth flows, no tokens to refresh, and no sessions to manage.At a glance#
| |
|---|
| Header | X-API-Key |
| Required on | All /api/companies/*, /api/persons/*, /api/stocks/* endpoints |
| Not required on | /health, /api-docs |
| Example value | nrt_live_abc123... |
The scheme is declared in the OpenAPI spec as apiKeyAuth (type: apiKey, location: header, name: X-API-Key).Sending the key#
curl#
JavaScript (fetch)#
Node.js (server-side)#
Read the key from an environment variable. Don't hard-code it.Credits and rate limits#
Every authenticated request is metered:1.
The gateway validates the key and looks up the per-endpoint credit cost.
2.
It atomically deducts that many credits from your team's wallet.
3.
Successful responses include X-Credit-Cost, X-Remaining-Balance, and X-RateLimit-* headers.
4.
If the upstream service fails (5xx), the credits are automatically refunded — you do not pay for failed requests.
If you run out of credits, the API returns 402 INSUFFICIENT_CREDITS. If you exceed your rate-limit window, it returns 429 RATE_LIMIT_EXCEEDED. See Errors for the full taxonomy.Obtaining a key#
API keys are issued out-of-band. Contact your swissgraph administrator to request a key. There is no public signup endpoint yet.When you receive your key:Treat it as a secret. Never commit it, never embed it in client-side JavaScript, never log it.
Rotate immediately if a key is exposed.
Errors you may encounter#
| HTTP | Code | What happened |
|---|
401 | MISSING_API_KEY | The X-API-Key header was not sent. |
401 | INVALID_KEY / KEY_REVOKED / KEY_EXPIRED | The key was sent but is not valid. |
402 | SUBSCRIPTION_REQUIRED / FEATURE_UNAVAILABLE | Your plan does not cover this endpoint. |
402 | INSUFFICIENT_CREDITS | Your wallet balance cannot cover this call. |
403 | SCOPE_MISMATCH | The key is valid but lacks scope for this endpoint. |
429 | RATE_LIMIT_EXCEEDED | Too many requests in the current window. Back off. |
Only X-API-Key is needed#
X-API-Key is the only authentication header the API expects. You don't need to send a Bearer token, an Authorization header, or any other credential. Modified at 2026-05-01 06:35:25