Quickstart

This quickstart lists the digital credentials your organisation has issued. It only reads data, so it is a safe first request.

Before you begin

• Your organisation needs an Arrota plan that includes API access. See Pricing.
• You need the Super Admin or Admin role in your organisation's workspace to create API keys.

1. Create an API key

1. Sign in to your issuer dashboard and open Settings, then API & Webhooks.
2. Select Create Key, give it a label such as "Quickstart", and keep the credentials:read scope selected.
3. Copy the key. Arrota shows it once and never again.

Store the key as a secret, for example in an environment variable. See Authentication.

2. Use the base URL

All endpoints live under one versioned base URL:

https://app.arrota.com/api/v1

3. Make a request

Send the key in the Authorization header as a Bearer token.

curl "https://app.arrota.com/api/v1/credentials?limit=1" \
  -H "Authorization: Bearer $ARROTA_API_KEY"

const response = await fetch("https://app.arrota.com/api/v1/credentials?limit=1", {
  headers: { Authorization: `Bearer ${process.env.ARROTA_API_KEY}` },
});
const body = await response.json();
console.log(response.status, body);

4. Read the response

A successful request returns 200 with a page of credentials and a cursor for the next page.

{
  "data": [
    {
      "id": "5b6f0c2a-1d3e-4f5a-9b7c-8d9e0f1a2b3c",
      "type": "Certification",
      "status": "active",
      "recipient_name": "Alex Rivera",
      "issued_on": "2026-09-18",
      "expires_on": null
    }
  ],
  "next_cursor": "eyJjIjoiMjAyNi0wOS0xOFQxNDowMjoxMS40ODI5MTMrMDA6MDAiLCJpIjoiNWI2ZjBjMmEtMWQzZS00ZjVhLTliN2MtOGQ5ZTBmMWEyYjNjIn0"
}

Every response also carries X-API-Version: 1 and rate-limit headers. If your organisation has not issued anything yet, data is an empty array and next_cursor is null.

5. Handle a basic error

A missing or malformed key returns 401:

{ "error": "Provide an API key: Authorization: Bearer arr_live_…" }

A key without the right scope returns 403:

{ "error": "This key does not have the credentials:read scope." }

Errors always carry a readable error message. See Errors for every status the API returns.

Next steps

• Issue a credential from your system of record.
• Configure a webhook endpoint to hear when credentials are claimed or revoked.
• Read the API overview for versioning, pagination and limits.