Skip to main content

​
Authentication Methods

The API authenticates requests with an API token sent as X-Aegister-Token. To create one, see Token.

​
1. Header-Based Authentication

Include the X-Aegister-Token in the request headers. This is the supported method: it keeps the token out of the URL and out of server logs. Example Request:
Curl Example:
Example Response (fields trimmed):
A missing or invalid token returns HTTP 401:

​
2. Query Parameter Authentication (deprecated)

Passing the token in the URL, as an X-Aegister-Token query parameter, is deprecated and will be removed. A token in the URL ends up in proxy and server logs and in browser history. Send the X-Aegister-Token header instead, as shown above.

​
Rate limits

Every API call counts towards a limit per user account: 300 calls a minute, shared by all your tokens and your console session. Some costly calls have their own limit, also per user: Aegister can also set a daily cap on a token, or on one endpoint for your account. Over a limit the call answers HTTP 429 with a Retry-After header, in seconds:
Wait that many seconds and try again. After a daily cap, Retry-After counts to midnight UTC, and the refused call is not counted.

​
Request size

A request body over 32 MB is refused with HTTP 413:
The server answers without reading the rest of the upload, so some clients report a dropped connection or a 502 instead. Send a large log file raw (application/octet-stream, up to 100 MB): see “Create log analysis”.