Skip to main content
Applies to Settings → API Keys with Generate API Key and named key rows. API keys authenticate applications that use Atoti Risk Services endpoints. Each key remains associated with a Risk Portal account. Creating a key does not grant additional report, portfolio, or market-data permissions.

​
What is required before creation?

  • Access to the intended Risk Portal account.
  • The account password, or the supported single sign-on flow.
  • A current MFA Code when requested.
  • Fewer than two existing API keys.
  • An approved secure location for the key.
These procedures cover password authentication and the supported single sign-on window. For other identity configurations, confirm the available authentication method with the administrator.
An API key is a credential. Keep key values out of shared documents, screenshots, source code, and support messages.

​
How to generate a key

  1. Open Settings → API Keys.
  2. Select Generate API Key. The Create API Key dialog opens.
  3. Enter a recognizable API Key Name, using at most 200 characters.
  4. Enter the account password if Password appears.
  5. Enter the current authentication code if MFA Code appears.
  6. Select Generate.
  7. Complete authentication in the separate window if the single sign-on flow opens.
  8. Reload API Keys after creation finishes.
Verify that the named key appears without a loading or authentication error. A closed dialog or authentication window alone does not confirm creation. Check the refreshed list before retrying an uncertain request.

​
How to copy an existing key

  1. Open Settings → API Keys.
  2. Locate the intended Name.
  3. Select the copy icon beside that row’s Value.
  4. Store the copied value in the approved credential location.
The eye icon reveals or hides the displayed value. Existing keys can be revealed again; key values are not restricted to a single display. Keep the value hidden when screen sharing. A copy notification does not guarantee that the browser allowed clipboard access. If copying fails, check browser clipboard permissions before retrying. API requests use the key value in the x-api-key header. Use the Atoti Risk Portal API link on the screen to open the deployment’s API documentation. Endpoint access still depends on the associated account’s permissions.

​
How to replace a key used by an integration

When one slot is available, generate a replacement before removing the existing key. Update the integration’s credential and verify an authorized request with the replacement. Then delete the previous key using the procedure below. When both slots are occupied, identify each key’s consumers before choosing a key to remove. The page does not provide configurable key scopes or an expiration setting.

​
How to delete a key

Deleting a key can interrupt integrations that use it. Confirm the intended key and arrange any replacement before deletion.
  1. Open Settings → API Keys.
  2. Locate the intended Name.
  3. Select Delete on that row.
  4. Select Yes in Confirm Delete.
  5. Reload API Keys.
Verify that the selected row is absent after the list loads without errors. An empty list accompanied by a loading error does not confirm deletion. If the row remains, the deletion is not confirmed. For revocation checks, verify the affected integration separately. The list does not establish when existing sessions or in-flight requests stop working.

​
What can prevent key creation?

For account authentication controls, see Security. For access requirements, see User permissions.