Overview
The Turbo360 API uses API key-based authentication. Every API request must include a valid API key passed in the request header using the parameter name APIKey. API keys are generated in the Turbo360 portal and scoped to specific HTTP methods and modules at the time of creation. Permissions can be updated at any time after creation.
You can test authenticated API calls interactively using the Swagger UI at {application_url}/swagger/index.html, or use a tool such as Postman for automation workflows.
Business value
API key authentication gives account owners precise control over what external systems and scripts can access. Scoping keys by method and module limits exposure, and permissions can be adjusted at any time without issuing a new key.
Prerequisites
- A Turbo360 account with account owner privileges.
- Access to Settings > API keys in the Turbo360 portal.
Required permissions
Only account owners can generate and manage API keys.
Dependencies
- The modules you want to authorise must already be configured in your Turbo360 account.
- HTTP method and module permissions can be updated at any time from Settings > API keys.
How it works
When you generate an API key, you assign it a name, one or more permitted HTTP methods, and one or more permitted modules. Turbo360 uses this scope to validate every inbound API request against the key presented in the APIKey header. You can edit the allowed methods and modules on an existing key at any time without generating a new one.
Generated keys are listed on the API keys page. You can copy a key to the clipboard at any time, and keys can be edited or deleted based on your requirements.
To authenticate in the Swagger UI, click Authorize, enter your API key value in the APIKey (apiKey) field, and click Authorize. The key is applied as a header on all subsequent requests in that browser session.
- Only account owners can generate and manage API keys.
- Generated API keys can be edited and deleted based on user preference.
Steps
Use the following steps to generate an API key in the Turbo360 portal. Navigate to Settings > API keys to get started.
- Log in to Turbo360.
- Navigate to Settings > API keys.
- On the API keys page, click + Generate API key.
- Enter a name in the Name field.
- Under Allowed methods, select the HTTP methods the key should permit:
GET,POST,PUT,DELETE. - Under Allowed modules, select the modules the key should have access to: Business Applications, Business Activity Monitoring, Azure Documenter, Cost Analyzer.
- Click Create.
- The new key appears in the API keys list. Click the copy button to copy the key value to your clipboard.
- Include the key in all API requests using the request header parameter
APIKey.
Configuration
| Option | Type | Default | Required | Description | Allowed values |
|---|---|---|---|---|---|
| Name | String | — | Yes | A descriptive label for the key | Any text |
| Allowed methods | Multi-select | — | Yes | HTTP methods the key is permitted to use — editable at any time | GET, POST, PUT, DELETE |
| Allowed modules | Multi-select | — | Yes | Turbo360 modules the key can access — editable at any time | Business Applications, Business Activity Monitoring, Azure Documenter, Cost Analyzer |
Permission behavior
With account owner access: You can generate, edit, copy, and delete API keys from Settings > API keys.
Without account owner access: The API keys section is not accessible. Contact your account owner to obtain a key or request elevated access.
Example scenario
A team wants to integrate Cost Analyzer data into an internal dashboard. The account owner generates an API key named dashboard-readonly, scopes it to GET only, and selects Cost Analyzer as the only allowed module. The developer includes the key in the APIKey request header when calling Cost Analyzer endpoints. Later, when the team also needs write access for automation, the account owner edits the same key to add POST and PUT without generating a new one.
Limitations
- API key generation is restricted to account owners.
- The Swagger UI Authorize dialog must be completed each browser session; authorisation does not persist across sessions.
Troubleshooting
-
The Generate API key button is not visible.
Cause: The logged-in user does not have account owner privileges.
Fix: Log in with an account owner account, or ask your account owner to generate the key. -
The API key is not appearing after generation.
Cause: The page was navigated away from before the key was copied.
Fix: The key is listed on the API keys page and can be copied at any time using the copy button. -
An API request using the key returns 403 Forbidden.
Cause: The key is not scoped to the module or HTTP method being called.
Fix: Edit the key in Settings > API keys to add the required method under Allowed methods or the required module under Allowed modules. -
Swagger UI requests fail even after clicking Authorize.
Cause: The API key was entered incorrectly or the session dialog was closed without confirming.
Fix: Click Authorize again, re-enter the key value in the APIKey (apiKey) field, and click Authorize to confirm before closing the dialog. -
The key was deleted and API requests are now failing.
Cause: Requests referencing a deleted key are rejected.
Fix: Generate a new API key and update all integrations and scripts with the new value.
FAQs
-
Can I generate multiple API keys?
Yes. You can generate multiple keys, each with different names, methods, and module scopes. This lets you issue separate keys to different teams or integrations. -
Can I change a key's permissions after it has been generated?
Yes. You can edit the allowed methods and modules on any existing key at any time from Settings > API keys. -
How do I revoke API access for a specific integration?
Delete the API key assigned to that integration from Settings > API keys. The key is immediately invalidated and any requests using it will fail.