The base URL
Every path in this collection hangs off https://api.asanify.com, so the employee directory is https://api.asanify.com/v1/employees.
Sending your key
There is no OAuth handshake, no token refresh and no session. The key itself is the credential, and it goes on every single request as one of these two headers:
Authorization: Bearer <your-key>— the usual choice, and what every example in this collection uses.X-API-Key: <your-key>— the same key in a plain header, for stacks where setting an Authorization header is awkward.
They are interchangeable. Send one, not both.
Your first call
Put your key in an environment variable rather than pasting it into a command line, where it lands in your shell history:
export ASANIFY_API_KEY="the key you were given"
Then ask for two employees:
curl -s "https://api.asanify.com/v1/employees?limit=2" \ -H "Authorization: Bearer $ASANIFY_API_KEY"
A 200 with a JSON body means the key works and holds employees:read. Anything else is one of these:
401 — the key is missing, mistyped, revoked or expired. These are deliberately indistinguishable; check the value first, then ask your Asanify contact whether the key is still active.
403
insufficient_scope— the key is valid but was not grantedemployees:read. Try an endpoint you were granted, or see *Partner API: scopes, and how to ask for more*.403
tenant_inactive— your Asanify account is not currently active. This is a billing or account question, not an integration one.
Looking after the key
Store it in a secrets manager or an environment variable. Never in source control, never in a config file that gets committed, never in a shared document.
It is environment-specific. A key issued for production does not work anywhere else.
A leaked key cannot be reset. It has to be revoked and replaced, so tell your Asanify contact straight away if you think it has been exposed — an unrevoked key keeps working.