API Keys - Paradime

Paradime supports two types of API keys to authenticate calls to the Paradime API:

	Account API Keys	Workspace API Keys [legacy]
Scope	One or more workspaces in your account	A single workspace
Authentication	`Authorization: Bearer` token	`X-API-KEY` and `X-API-SECRET` headers
Workspace selection	Per request, using the `X-Paradime-Workspace` header	Fixed — bound to the workspace where the key was generated

Account API keys are the recommended way to authenticate with the Paradime API.A single account API key can access multiple workspaces, so you no longer need to generate and manage a separate set of credentials for each workspace. Workspace API keys remain fully supported for existing integrations.

Capabilities

Both key types grant access through the same set of capabilities (scopes). When generating a key you choose which capabilities to grant it.

Capabilities	Description
Audit logs viewer	This permission grants access to view and export Audit Logs.
Bolt schedules admin	This permission grants access to create and delete Bolt schedules, trigger and cancel Bolt runs, as well as access to Bolt schedules and runs’ metadata.
Bolt schedules metadata viewer	This permission grants access to Bolt schedules and runs’ metadata.
Catalog admin	This permission grants access to refresh dbt™ docs in the Paradime Catalog.
DinoAI agent API	This permission grants access to trigger DinoAI agent runs and read their output.
Custom integrations admin	This permission grants access to create and manage custom integrations.
User management admin	This permission grants access to invite, disabling, updating users in a workspace, as well as listing users’ metadata.
User metadata viewer	This permission grants access to view users’ metadata.
Workspace metadata viewer	This permission grants access to view the account workspaces’ metadata.

For an account API key, the granted capabilities apply to every workspace the key has access to. For a workspace API key, they apply to the single workspace the key belongs to.

Account API Keys

Account API keys are generated at the account level.A single account API key can be granted access to one or more workspaces in your Paradime account. You select the target workspace on each API request using the X-Paradime-Workspace header — so you no longer need separate credentials for each workspace.

Generate a new account API key

To generate an account API key, navigate to the Settings screen and select API Keys from the left panel. Click on Generate API Key.

Only workspace admins can generate account API keys, and a key can only be granted access to workspaces where you are an admin.

Here you will be able to:

Provide a human readable name to help identify what the API key is generated for
Set an optional expiration date, after which the key will no longer be valid
Grant a set of capabilities or scopes to the API key
Select one or more workspaces the API key can access

Make sure to store your API key securely in a password manager like 1Password/Lastpass/Dashlane.After refreshing/leaving this screen you won’t be able to retrieve the API key again.

Authenticate with your account API key

Account API keys use Bearer token authentication. On each request, pass:

The Authorization header with your account API key (starting with prdm_cmp_)
The X-Paradime-Workspace header with the workspace_token of the workspace you want the request to run against

The API endpoint is displayed when you generate the key. To find your workspace_token, see Company & Workspace token.

cURL
Python

curl -X POST "https://api.paradime.io/api/v1/<company_token>/graphql" \
  -H "Authorization: Bearer prdm_cmp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
  -H "X-Paradime-Workspace: <workspace_token>" \
  -H "Content-Type: application/json" \
  -d '{"query": "query { listWorkspaces { workspaces { name uid } } }"}'

import requests

api_endpoint = "https://api.paradime.io/api/v1/<company_token>/graphql"
api_token = "prdm_cmp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
workspace_token = "<workspace_token>"

response = requests.post(
    api_endpoint,
    json={"query": "query { listWorkspaces { workspaces { name uid } } }"},
    headers={
        "Authorization": f"Bearer {api_token}",
        "X-Paradime-Workspace": workspace_token,
        "Content-Type": "application/json",
    },
)
print(response.json())

To run the same operation against a different workspace, keep the same Bearer token and change the X-Paradime-Workspace header to the other workspace’s workspace_token. The API key must have been granted access to that workspace, otherwise the request will be rejected.

Account-wide operations that are not tied to a specific workspace (for example listing the workspaces in your account) can be called without the X-Paradime-Workspace header.

View existing account API keys

To view all active account API keys, navigate to the Settings screen and select API Keys from the left panel. For each API key you can see its name, the workspaces and capabilities it has been granted, when it was created, when it was last used, and its expiration date (if set).

Revoke account API keys

To revoke an account API key, navigate to the Settings screen and select API Keys from the left panel. Select the API key you want to revoke and choose the delete option.

Please note that this action is irreversible, and any API calls made using the revoked API key will fail.

Workspace API Keys [legacy]

Workspace API keys are a legacy feature. They remain fully supported for existing integrations, but we recommend using Account API Keys (above) for new integrations — a single Bearer token that can access multiple workspaces in your account.The key differences from account API keys: a workspace key is scoped to a single workspace, authenticates using the X-API-KEY and X-API-SECRET headers (not a Bearer token), and is bound to the workspace where it was generated (no X-Paradime-Workspace header). If you use multiple workspaces, you need a separate set of workspace credentials for each one.

Workspace API keys in Paradime are generated at a workspace level.If using multiple workspaces you will need to use different API credentials in the Authorization headers.

Generate a new set of API keys

To generate API credentials for making API calls in Paradime, navigate to the Settings screen and select Workspace Settings from the left panel. Scroll to the bottom of the screen and click on Generate API Keys. Here you will be able to:

Provide a human readable name to help identify what is the API key generated for
Set an optional lifetime in days for the API keys, after the credentials will expire those will not be valid
Grant a set of capabilities or scopes to the API keys

Make sure to store your API credentials securely in a password manager like Lastpass/Dashlane.After refreshing/leaving this screen you wont be able to retrieve the API keys again.

Authenticate with your workspace API keys

Workspace API keys authenticate using two request headers — X-API-KEY and X-API-SECRET — posted to your workspace’s API endpoint. Unlike account API keys, there is no Authorization: Bearer token and no X-Paradime-Workspace header: the key is already bound to a single workspace.

cURL
Python

curl -X POST "<API_ENDPOINT>" \
  -H "X-API-KEY: <YOUR_API_KEY>" \
  -H "X-API-SECRET: <YOUR_API_SECRET>" \
  -H "Content-Type: application/json" \
  -d '{"query": "query { ... }"}'

import requests

response = requests.post(
    "<API_ENDPOINT>",
    json={"query": "query { ... }"},
    headers={
        "X-API-KEY": "<YOUR_API_KEY>",
        "X-API-SECRET": "<YOUR_API_SECRET>",
        "Content-Type": "application/json",
    },
)
print(response.json())

View existing API keys details

To view all active account API keys, navigate to the Settings screen and select API Keys from the left panel. For each API key you can see its name, capabilities it has been granted, when it was created, when it was last used, and its expiration date (if set).

Revoke account API keys

To revoke an account API key, navigate to the Settings screen and select API Keys from the left panel. Select the API key you want to revoke and choose the delete option.

Please note that this action is irreversible, and any API calls made using the deleted API key will fail.

​Capabilities

​Account API Keys

​Generate a new account API key

​Authenticate with your account API key

​View existing account API keys

​Revoke account API keys

​Workspace API Keys [legacy]

​Generate a new set of API keys

​Authenticate with your workspace API keys

​View existing API keys details

​Revoke account API keys

Capabilities

Account API Keys

Generate a new account API key

Authenticate with your account API key

View existing account API keys

Revoke account API keys

Workspace API Keys [legacy]

Generate a new set of API keys

Authenticate with your workspace API keys

View existing API keys details

Revoke account API keys