Skip to main content

Platform API Access

The Platform API is for platform operators — the people who run an Allegro installation, not the organizations hosted on it. Its endpoints report on the platform as a whole: the tenants it hosts and the health of its queues.

Not part of the organization-facing API

These endpoints are not available to organizations. If you are integrating an application against a single organization's data, you want the REST API instead.

Where it is served​

The Platform API is served only from the platform host, never from an organization subdomain:

https://allegrocdp.com/api/v1/landlord/...

A request to an organization host such as acme.allegrocdp.com is rejected with 403 Forbidden, even with a valid key.

Platform keys only​

Every Platform API request must carry a platform-owned API key. Allegro rejects all other credentials with 403 Forbidden:

CredentialResult
Platform keyAllowed
Organization key (Organization Settings → API Keys)403 Forbidden
Key belonging to an individual user403 Forbidden

The last row applies even when that user is a super admin. Being a super admin grants access to the Allegro admin; it does not grant an individual's API key access to the Platform API.

Creating a platform key​

  1. Sign in to the Allegro admin as a super admin.
  2. Open Global Settings → API Keys.
  3. Click Create Key, give it a descriptive name (e.g. platform-monitor), choose its scopes, and confirm.
  4. Copy the key value that appears — it is only shown once.
Store your key securely

The key value is displayed only at creation time. If you lose it, revoke the key and create a new one.

Platform keys carry the same resource:action scopes described in API Authentication. A key whose scopes do not cover the endpoint it calls is rejected with 403 Forbidden even though it is otherwise valid.

Using the key​

Send the key as a Bearer value in the Authorization header:

curl https://allegrocdp.com/api/v1/landlord/health \
  -H "Authorization: Bearer <your-key>" \
  -H "Accept: application/json"

Revoking a key​

Return to Global Settings → API Keys, find the key, and click Revoke. It stops working immediately.