Authentication
Integrations authenticate with a personal access token. Do not use the short-lived JWT the web app gets from login.
Personal access tokens
Create, list, and revoke tokens in EASI 4.0 → Settings → API access,
or via POST /v1.0/user/tokens/ while you are logged in with a JWT.
The create response includes the raw token once; EASI 4.0 stores only a hash after
that.
| Property | Notes |
|---|---|
| Format | pat_ prefix, sent as Authorization: Bearer pat_… |
| Expiry | Optional. You can create a token with no expiry, 30 days, 90 days, or 1 year. |
| Scope | Acts as the user who created it, including their company memberships. |
Company header
Almost every operational endpoint is tenant-scoped. Send the company UUID on every call:
X-Company: 3f1c0a2e-7b64-4d1a-9c8e-0b2a1d4e5f60
If the header is missing, EASI 4.0 returns 400. If the user is not a
member of that company, 403.
What not to use
POST /v1.0/user/login/ returns JWT access and refresh tokens for the
EASI 4.0 web application. They expire quickly and are a poor fit for a service
account. Prefer a PAT created for a dedicated integration user.