Get Your API Key

Before an application can communicate with INNORIX, it must first authenticate. Exacoola authenticates using an access token (JWT) issued at login. The base URL is https://app.innorix.com.

• Login (POST /api/auth/login) — Sign in with an account to receive an access token and refresh token.
• Issue API key (POST /api/auth/api-keys) — Issues a general user API key. Use it in the x-api-key header. (The external trigger key dedicated to command automation is issued separately through GET /api/command/generate-api-key — see Automate File Transfers.)

For API calls that require authentication, send the following two headers together.

Authorization: Bearer <ACCESS_TOKEN>
x-workspace-id: <WORKSPACE_ID>

Login

POST /api/auth/login — User login

curl -X POST https://app.innorix.com/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "<YOUR_EMAIL>",
    "password": "<YOUR_PASSWORD>"
  }'

Response:

{
  "status_code": 200,
  "message": "success",
  "data": {
    "user": {
      "email": "user@example.com",
      "userName": "User Name",
      "userId": "usr_abc123",
      "state": "1",
      "accessToken": "<ACCESS_TOKEN>",
      "refreshToken": "<REFRESH_TOKEN>"
    }
  }
}

Use data.user.accessToken in the Authorization: Bearer header for subsequent requests. When the access token expires, issue a new token through POST /api/auth/token/refresh.

Issue API Key (for Command Automation)

POST /api/auth/api-keys — Create an API key for the signed-in user

curl -X POST https://app.innorix.com/api/auth/api-keys \
  -H "Authorization: Bearer <ACCESS_TOKEN>" \
  -H "x-workspace-id: <WORKSPACE_ID>"

Response:

{
  "status_code": 200,
  "message": "success",
  "data": {
    "apiKey": "a3f2c1..."
  }
}

Use the issued apiKey in the x-api-key header for command automation trigger requests. To revoke a key, call DELETE /api/auth/api-keys with body { "apiKey": "a3f2c1..." }.

Token Refresh · Session Management

When the access token expires, use the refresh token to issue a new token. Send the refresh token in the X-Refresh-Token header.

POST /api/auth/token/refresh — Refresh session tokens

curl -X POST https://app.innorix.com/api/auth/token/refresh \
  -H "X-Refresh-Token: <REFRESH_TOKEN>"

Response:

{
  "status_code": 200,
  "message": "success",
  "data": {
    "accessToken": "<NEW_ACCESS_TOKEN>",
    "refreshToken": "<NEW_REFRESH_TOKEN>",
    "expiresIn": 3600,
    "userId": "usr_abc123",
    "email": "user@example.com",
    "userName": "User Name"
  }
}

Other session management endpoints: