Make your first API request

Use the public REST API when your code runs on your own server: a website backend, a synchronization worker, or a command-line tool. A campai developer app runs inside campai and has a different execution and permission model. You do not need to create a developer app to call the REST API.

The first request reads the key's organization and permissions without changing organization data.

Read Understand money, dates, and data types before mapping amounts, dates, IDs, or missing fields into your own system.

Create your key in app.campai.com. Send REST requests to https://cloud.campai.com/api. The admin application's hostname is not an API endpoint.

The base URL includes /api; append the operation path from the reference. For example, /apiKey/info becomes https://cloud.campai.com/api/apiKey/info.

An organization owner creates and manages API keys. In the intended organization:

1. Open More → Developers → API Keys.
2. Choose Create API Key and enter a description identifying the integration.
3. Choose English for the key's language if you want English server messages.
4. Select the permissions your integration needs under Management permissions. For the next guide, select Mandates → Read. Reading members, events, or receipts requires their separate scopes.
5. If the integration should access only one mandate, select it under Restrictions.
6. Create the key and copy the complete value into your server's secret store. The creation dialog shows it once. The masked value in the list is not usable as a credential.

The key belongs to one organization. Its permissions do not automatically equal the permissions of the person who created it. A key with no data permissions can still be inspected through GET /apiKey/info.

Never put the key in client-side JavaScript, a widget's client project, a WordPress page, a URL, or a public repository. Calls from a public website go through your backend.

Replace YOUR_API_KEY with your complete key and copy the example for your preferred language. Run cURL in your terminal. For Node.js 22 or later, save the code as example.mjs and run node example.mjs. For PHP 8.2 or later, save it as example.php and run php example.php; HTTPS streams must be enabled with allow_url_fopen. No npm packages, Composer packages, SDK, or helper file are needed.

curl --fail-with-body --silent --show-error --max-time 30 --globoff \
  --request GET 'https://cloud.campai.com/api/apiKey/info' \
  --header 'X-API-Key: YOUR_API_KEY'

The header is X-API-Key with the complete key as its value. Do not add Bearer. A successful response has organization and permissions at its top level, without a data wrapper. Keep the full organization ID for later requests and confirm it belongs to the intended organization before making changes.

These examples make one attempt, reject HTTP errors, and do not follow redirects. A timeout limits the wait but cannot undo a request already accepted by the server. Follow Handle API errors and retries before adding retries.

Use placeholders only for local setup. In your deployed integration, load the key from your server's secret configuration and keep it out of committed source files.

Result	What to check
HTTP 401, UNAUTHORIZED	The authentication header is absent. Confirm you replaced the key placeholder and your proxy forwards the header.
HTTP 400, Invalid x-api-key header	The value is malformed or invalid. Copy the full key, without the masked suffix, surrounding quotes, spaces, or a Bearer prefix.
HTTP 403 on a data operation	Authentication succeeded but the organization, scope, action, or mandate restriction does not allow this operation. Inspect the structured error.
HTML instead of JSON	Check the cloud hostname and /api prefix. An admin application URL is not a REST endpoint.
Network or timeout error	Check connectivity and the API address before retrying. No HTTP response does not establish whether a write ran.

Once the key check succeeds, continue with Find your organization and mandate IDs. Do not start debugging a complex filter before this basic request works.