API
Authentication
Send x-api-key on every /v1 request. Keys use the cimg_live_ prefix.
Every /v1 endpoint except the unauthenticated root (GET /v1) requires a header:
x-api-key: cimg_live_…Example:
curl -H "x-api-key: YOUR_KEY" \
"$APP_URL/v1/me"Key format
Live secrets start with cimg_live_. The dashboard and admin UI only store a hash; the full secret is displayed once at creation.
Failures
| Status | error | When |
|---|---|---|
| 401 | unauthorized | Missing x-api-key |
| 401 | unauthorized | Unknown or revoked key |
| 403 | forbidden | Organization has no active contract |
| 403 | forbidden | A member of the organization is banned |
Error bodies are JSON { "error", "message" }. See Errors & quotas.
Root (no key)
curl "$APP_URL/v1"Returns { "name": "cargoimg", "version": "1.0.0", "docs": "/docs" }.