API Keys

API keys let you authenticate with the Timefold Model APIs without a user context. This page describes how to generate and revoke API keys in the Platform UI.

See Model API usage for recommended permissions for common integration patterns.

Generating API keys

When you are logged in, click on the dropdown at the top right next to your username. Click on Manage tenant. In the menu on the left hand side click API Keys to access the API Keys available for your tenant.

  1. Click Create API Key to generate a new API Key.

  2. Select All Models or Selected Models and specify which models the key has access to.
    We recommend creating one key for each model you use.

  3. Select All Permissions or Selected Permissions and specify which permissions the key has.

    The Read permission can be used with the GET method to retrieve existing information. It cannot be used, for instance, to request recommendations as this involves creating the recommendations.

  4. Specify an expiry duration.
    If you don’t pick a date, the key will expire after 30 days.

  5. Give the API a descriptive name.

  6. Click Add API Key.

All API Keys generated for a tenant are visible for all administrators of the tenant. An API Key doesn’t have any user context and is purely connected to the tenant (and optionally to the models of the tenant).

Revoking API keys

From the API Keys overview table you can revoke existing keys. This can be done if an API key is no longer needed, or if an API key has leaked. Once an API key is revoked, all subsequent API calls where the key is used will fail.

API key permissions

The table below lists which permissions can call which model endpoints and will help decide which API keys require which permissions.

Method Endpoint Create Read Update Delete

POST

/{version}/{resource}

Yes

No

No

No

DELETE

/{version}/{resource}/{id}

No

No

Yes

No

GET

/{version}/{resource}/{id}

Yes

Yes

Yes

Yes

POST

/{version}/{resource}/{id}

No

No

Yes

No

PUT

/{version}/{resource}/{id}

No

No

Yes

Yes

POST

/{version}/{resource}/{id}/from-input

Yes

No

No

No

POST

/{version}/{resource}/{id}/from-patch

Yes

No

No

No

PATCH

/{version}/{resource}/{id}/metadata

No

No

Yes

No

POST

/{version}/{resource}/{id}/new-run

Yes

No

No

No

DELETE

/{version}/{resource}/{id}/purge

No

No

No

Yes

PATCH

/{version}/{resource}/{id}/run

No

No

Yes

No

GET

/{version}/{resource}/{id}/{subresource}

Yes

Yes

Yes

Yes

GET

/{version}/{resource}/{id}/*

Yes

Yes

Yes

Yes

POST

/{version}/{resource}/recommendations/

Yes

No

No

No

POST

/{version}/{resource}/{id}/recommendations/

Yes

No

No

No

POST

/{version}/{resource}/score-analysis

Yes

No

No

No

GET

/{version}/{resource}/{id}/score-analysis

Yes

Yes

Yes

Yes

GET

/{version}/{resource}/validation-issue-types

No

Yes

No

No

GET

/{version}/{resource}/validation-issue-types/{code}

No

Yes

No

No
When deciding on which permissions to grant an API key, we recommend following the Principle of Least Privilege and only providing the permissions required for the task the API key has been created for.