Applies to the documented Risk Portal API and accounts with API-key authentication available.
An API request combines a server address, an endpoint path, and the required authentication and inputs.
Endpoint access depends on the associated account’s permissions.
An API key does not add report, portfolio, or market-data access.
What is required?
- The API host for the intended environment.
- An API key associated with the intended account.
- Permission to perform the selected operation.
- Any identifiers and input data required by that endpoint.
See API keys for creation, copying, replacement, and deletion.
See User permissions for account and resource access.
Where are endpoint details documented?
The API reference navigation group contains endpoint pages generated from the documentation’s OpenAPI contract.
Select an operation to inspect its parameters, request body, responses, and data models.
The reference reflects the contract included with this documentation.
Confirm that the documented operation is available in the intended environment.
How to prepare the request
An exposed API key can authenticate requests with the associated account’s permissions.
Keep key values out of source code, shared examples, screenshots, and support messages.
Store credentials using the integration’s approved secret-management mechanism.
- Confirm the API host for the intended environment.
- Open the required operation under API reference.
- Select its documented HTTP method in the API client.
- Append the documented endpoint path to the confirmed host.
- Add the key value to the
x-api-key request header.
- Supply the documented path parameters, query parameters, and request body.
- Review the documented permissions, defaults, and side effects before sending the request.
Which environment receives requests?
Requests go to the API host selected in the client or interactive reference.
Confirm the displayed server before authenticating or executing an operation.
Operations that create, update, or delete resources affect that environment.
What needs verification?
Check the response status and body against the selected endpoint’s documented responses.
A successful authentication does not establish permission for every operation.
For asynchronous operations, follow the endpoint’s documented status or result-retrieval process.
An accepted request does not necessarily mean processing has finished.
The OpenAPI contract also describes token-based authentication.
Token acquisition and identity-provider configuration depend on the environment.
Use the configured authentication instructions when an integration requires that method.
Where is the Python client reference?
For Python client functions and data types, see the Python client reference. 
