FAQ
Answers to common questions about the Elastio API. For problems with specific requests, see Troubleshooting.
Is the Elastio API REST or GraphQL?
Section titled “Is the Elastio API REST or GraphQL?”REST. You call HTTPS endpoints with standard methods (GET, POST, PUT, PATCH, DELETE) and exchange JSON. There is no GraphQL endpoint.
What is the base URL?
Section titled “What is the base URL?”Your tenant: https://{tenant}.app.elastio.com, where {tenant} is the subdomain you use to sign in to the Elastio console. There is no shared, global API host.
Where is the OpenAPI specification?
Section titled “Where is the OpenAPI specification?”At /openapi/elastio-api.json. It is an OpenAPI 3.0.3 document describing every published operation, and the API reference is generated from it. You can also download it from the reference.
How do I authenticate?
Section titled “How do I authenticate?”With a personal access token, sent as Authorization: Bearer <token>. Tenant admins issue tokens in the console or with POST /gateway/shared-services/v1/personal-access-tokens. See Authentication.
Who can create API tokens?
Section titled “Who can create API tokens?”Tenant admins. The token endpoints return 403 for other users. Each token belongs to the user who issued it, and the list, update and revoke operations act on that user’s own tokens.
I lost my token. Can I see it again?
Section titled “I lost my token. Can I see it again?”No. The raw token is returned only once, when it is issued. Revoke the lost token and issue a new one.
Do tokens expire?
Section titled “Do tokens expire?”Only if you set expires_at when you issue or update the token. A token without expires_at never expires. Setting an expiry and rotating tokens is recommended. See Expiry and rotation.
How do I limit what a token can do?
Section titled “How do I limit what a token can do?”Give it specific grants instead of all_scopes. Each grant pairs a category (inventory, security, protection, reporting, integrations or admin) with read or write access, and write implies read. See Scopes.
Is there a sandbox environment?
Section titled “Is there a sandbox environment?”There is no separate sandbox. To experiment safely, issue a token with only read grants and use it against your own tenant, in your code or in the API console. Read operations don’t change data.
Can I try requests without writing code?
Section titled “Can I try requests without writing code?”Yes. Connect your tenant in the API console and use Test Request on any operation in the API reference. Write operations change real data, so use a read-only token while you explore.
Are there official SDKs?
Section titled “Are there official SDKs?”See SDKs & Tools for what is available. You can also generate a client in your language from the OpenAPI document with any OpenAPI generator.
What are the rate limits?
Section titled “What are the rate limits?”The OpenAPI document doesn’t publish general rate limits. A small set of operations document 429 Too Many Requests, such as the EQL operations, VirusTotal lookups and PDF rendering. Handle 429 with exponential backoff wherever it appears, and avoid tight polling loops. See Errors.
Why do different endpoints paginate differently?
Section titled “Why do different endpoints paginate differently?”The API is served by several backend services behind one gateway, and they use different pagination styles: token (page_size and next_page_token), camelCase token (pageSize and pageToken), and offset (limit and offset). Check each operation’s parameters. See Pagination.
Why do paths have different versions?
Section titled “Why do paths have different versions?”Versions are per service and resource, not global, so one integration can call v1, v2 and v3 paths at the same time. For new work, use the highest version published for the resource. See Versioning.
How will I know when an endpoint is deprecated?
Section titled “How will I know when an endpoint is deprecated?”Deprecated operations carry deprecated: true in the OpenAPI document, are labelled in the reference, and are listed on Deprecations with their replacements. Changes are recorded in the changelog.
How do I get help?
Section titled “How do I get help?”Use the support portal or email support@elastio.com. See API support for what to include.