Connections: create and revoke API keys
Let your own systems (payroll, ERP, a dashboard) read your iComply records with an API key: choose what it can read, copy it once, revoke it any time.
2 min readLast updated
Applies to: Integrations · Administrator
Connections is where administrators connect iComply to your own systems: API keys to read your records, webhooks that tell your systems when something happens, and single sign-on. It's part of the Integrations pack, for every kind of organisation.
Before you start
- Integrations is on in Settings → Your packs.
- Only administrators can open Connections.
How to create a key
- Step 1: Open Organisation → Connections.
- Step 2: Under API keys, open Create a key.
- Step 3: Give it a Name (what uses it), such as "Payroll system".
- Step 4: Under It can read, tick only the scopes it needs.
- Step 5: Set Stops working after: 90 days from today unless you change it, a year at most.
- Step 6: Choose Create key and copy it straight away. It's shown once and never again.
The scopes
- read:subcontractors: your contractors and their status (on each site too). The name stays the same whatever you call them.
- read:sites: your sites.
- read:gate: who's on site now, and gate events (sign-ins, refusals, overrides).
- read:safety: the incident summary (counts only) and corrective actions.
- read:compliance: documents and tickets expiring.
- read:insights: the Insights feed for Power BI. Offered only while Insights is on.
How to revoke a key
- Step 1: In the keys table, open Revoke beside the key.
- Step 2: Type Why, then choose Revoke now. It stops working straight away.
The table shows each key's name, first characters, who made it, its scopes, the last day it works, when and from where it was last used, and its state.
Limits
- A key lasts a year at most: make a new one before it ends.
- 120 requests a minute per key.
- A key stops working if Integrations is switched off.
iComply keeps only a fingerprint of each key, never the key itself, so a lost key can't be shown again: revoke it and make a new one. Every request a key makes is in Who looked at what.