Skip to main content
The ROOTKey API is a REST API that gives you programmatic access to vault management, file integrity anchoring, validation, and analytics. All communication happens over HTTPS with JSON request and response bodies. How each write operation is protected depends on the configured data processing protocol - anchored to the Polygon blockchain (RKP-1, and the on-chain path of RKP-3) or recorded off-chain (RKP-2).

​
Architecture

Blockchain anchoring is asynchronous: the API responds with the operation in PENDING state and its transaction hash, and the anchor is confirmed once the transaction is mined. This applies to RKP-1 and to the on-chain path of RKP-3. RKP-2 writes nothing on-chain.

​
Core Resources

Vaults

Vaults are the top-level containers for your files. Each vault has its own protocol configuration, access controls, and lifecycle management.

Files

Files are the primary asset type within a vault. Each file supports versioning, validation, and history traversal - all with integrity anchoring.

Records

Individual records within a table, with full version history and per-record integrity validation.

Data Recovery

Restore soft-deleted vaults and files within the recovery window. Blockchain anchors are unaffected - on-chain proofs remain valid regardless of deletion state.

​
Key Capabilities

​
Base URLs

All endpoints are relative to this base URL. There is no separate development host: to try things out, use a test API key against the same API. See Test and Live Data.

​
Authentication

Every request must include your API key in the x-api-key header:
API keys are scoped to a workspace, and each one is either a test key or a live key: a test key works on your organization’s test data, a live key on its live data. Generate and manage your keys from the ROOTKey platform dashboard. See API Keys for step-by-step instructions.
Never expose API keys in client-side code, public repositories, or logs. Rotate keys immediately if you suspect a compromise.

​
Protocol Configuration

Each vault is configured with a data processing protocol that determines how writes are anchored:

​
Request Format

All request bodies must be sent as JSON with the Content-Type: application/json header.

​
Response Format

Responses are JSON objects. Successful responses return a 2xx status code. Errors return a structured object with a machine-readable code and a human-readable message. See Error Reference for the full error schema.

​
Rate Limits

Each plan has its own API rate limit, in requests per minute, and some operations, such as listing and restoring deleted items, have limits of their own. Over a rate limit the API answers 429 Too Many Requests with a Retry-After header. Your plan also sets quotas, such as a monthly number of API requests; a request over a quota is refused with usage_limit_exceeded. When ROOTKey is too busy to take a request it answers 503 Service Unavailable, also with Retry-After. See Rate Limits for the limits, and Retrying a failed request for which failures are safe to send again.

​
Versioning

The API is versioned. Breaking changes are introduced only in new major versions with advance notice. See API Versioning for the full versioning policy and deprecation timelines.

​
Support

If you encounter issues or have questions about the API, contact our team at [email protected] or visit the Support page.