Authentication

Partner endpoints under /api/v1 are authenticated with an API key.

API key header

Create a key in the Control console (Settings → API keys), then send it on every request:

curl "https://api.control.cm/api/v1/me" \
  -H "x-api-key: YOUR_API_KEY"

You can also use Authorization: Bearer YOUR_API_KEY.

Verify the key

GET /api/v1/me returns the key identity (company id, key id, name, rate limit). It does not return company data — use it as a connectivity check, then call /company, /vehicles, or /drivers for data.

Response shape

Success:

{
  "data": { },
  "meta": { "requestId": "req_…" }
}

List endpoints also return meta.cursor / meta.next for pagination (?cursor=&limit=).

Errors:

{
  "error": {
    "code": "not_found",
    "message": "Resource not found.",
    "requestId": "req_…"
  }
}

Stable error codes: unauthorized, forbidden, not_found, rate_limited, validation_failed, conflict, unprocessable, internal.

Rate limits

Each key has a per-minute request limit. Responses include X-RateLimit-* headers; exceeding the limit returns 429 with error.code = rate_limited.

Keep keys secret. Rotate them in the console if compromised.