Authentication

The Direct API authenticates every request with an API key passed in the x-api-key header.

curl https://api.global.direct.reap.global/{version}/health \
  -H "x-api-key: YOUR_API_KEY"

API keys

Keys are issued per business. After Direct API access is enabled, a team administrator creates and manages keys from the Reap dashboard.
Keys carry scopes that limit which endpoints they can call.
Requests without a valid key receive 401 Unauthorized; requests with a valid key but insufficient scope receive 403 Forbidden.
Key management (creating, listing, updating, and revoking keys) is restricted to team administrators signed in to the dashboard; other roles receive 403 Forbidden. Keys themselves cannot manage keys.

Scope	Endpoints
`card_activities:read`	`GET /activities`
`card_account_balances:read`	`GET /cards/balances`
`cards:read`	`GET /cards`, `GET /cards/categories`, `GET /cards/{cardId}`
`cards:read_vault`	`POST /cards/{cardId}/reveal`
`cards:write`	`POST /cards`, `PUT /cards/{cardId}`, `DELETE /cards/{cardId}`, `PUT /cards/{cardId}/freeze`, `PUT /cards/{cardId}/unfreeze`, `PUT /cards/{cardId}/restriction`
`spend_controls:write`	`PUT /cards/{cardId}/spend-control`
`team_members:read`	`GET /team-members`
No scope	`GET /health` (a valid API key is still required)

Treat API keys like passwords. Store them in a secrets manager, never commit them to source control, and rotate them immediately if exposed.