Consumer API
Authentication
Every request requires a Bearer API key:
Authorization: Bearer ves_live_<your-key>There is no organizationId anywhere in this API - your organization is always the one the key belongs to. A request is scoped to that organization automatically; there is nothing for a caller to spoof.
curl -H "Authorization: Bearer ves_live_example" \
https://your-deployment.example.com/api/consumer/v1/locationsThe example above (and every example in these docs) uses a placeholder value - never a real credential.
Authentication failures
| Status | Meaning |
|---|---|
| 401 | Missing, malformed, invalid, revoked, or expired key |
| 403 | The key authenticated fine but lacks the scope the endpoint requires |
| 429 | Rate limit exceeded - see the Retry-After header for how long to wait |
Errors
Every error response has the same shape:
{ "error": "Human-readable message" }Validation errors additionally include an issues object keyed by field name. Raw API keys are never echoed back in an error response, logged, or included in any response body - only a non-secret prefix (ves_live_xxxxxxxx...) is ever shown, and only in the dashboard's key list.
See API Keys for how to create, scope, and revoke a key.