# Platform API Access

The Platform API is for **platform operators** — the people who run an Allegro installation, not the organizations hosted on it. Its endpoints report on the platform as a whole: the tenants it hosts and the health of its queues.

Not part of the organization-facing API

These endpoints are not available to organizations. If you are integrating an application against a single organization's data, you want the [REST API](/rest-api) instead.

## Where it is served[​](#where-it-is-served "Direct link to Where it is served")

The Platform API is served only from the platform host, never from an organization subdomain:

```text
https://allegrocdp.com/api/v1/landlord/...

```

A request to an organization host such as `acme.allegrocdp.com` is rejected with `403 Forbidden`, even with a valid key.

## Platform keys only[​](#platform-keys-only "Direct link to Platform keys only")

Every Platform API request must carry a **platform-owned** API key. Allegro rejects all other credentials with `403 Forbidden`:

| Credential                                              | Result          |
| ------------------------------------------------------- | --------------- |
| Platform key                                            | Allowed         |
| Organization key (**Organization Settings → API Keys**) | `403 Forbidden` |
| Key belonging to an individual user                     | `403 Forbidden` |

The last row applies even when that user is a super admin. Being a super admin grants access to the Allegro admin; it does not grant an individual's API key access to the Platform API.

## Creating a platform key[​](#creating-a-platform-key "Direct link to Creating a platform key")

1. Sign in to the Allegro admin as a super admin.
2. Open **Global Settings → API Keys**.
3. Click **Create Key**, give it a descriptive name (e.g. `platform-monitor`), choose its scopes, and confirm.
4. Copy the key value that appears — it is only shown once.

Store your key securely

The key value is displayed only at creation time. If you lose it, revoke the key and create a new one.

Platform keys carry the same `resource:action` scopes described in [API Authentication](/developer/api/authentication.md#token-scopes). A key whose scopes do not cover the endpoint it calls is rejected with `403 Forbidden` even though it is otherwise valid.

## Using the key[​](#using-the-key "Direct link to Using the key")

Send the key as a `Bearer` value in the `Authorization` header:

```bash
curl https://allegrocdp.com/api/v1/landlord/health \
  -H "Authorization: Bearer <your-key>" \
  -H "Accept: application/json"

```

## Revoking a key[​](#revoking-a-key "Direct link to Revoking a key")

Return to **Global Settings → API Keys**, find the key, and click **Revoke**. It stops working immediately.