Authentication

Every API request requires an API key and tenant ID.

Required Headers

Header	Required	Description
Authorization	Yes	Bearer YOUR_API_KEY
X-Tenant-ID	No	Optional — the API key already identifies your workspace. Ignored when a key is present.
Content-Type	Yes	application/json for POST/PUT requests

Example request:

curl https://sandbox.korastratum.com/api/v1/screenings \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "X-Tenant-ID: YOUR_TENANT_ID" \
  -H "Content-Type: application/json"

Getting Your Credentials

1. Sign up at sandbox.korastratum.com
2. Navigate to Settings → API Keys in the dashboard
3. Copy your API Key and Tenant ID

Environments

Environment	Base URL
Sandbox	https://sandbox.korastratum.com/api/v1
Production	https://compliance.korastratum.com/api/v1

info

Each environment has its own host — they are not interchangeable. Use a sandbox key (sk_sandbox_…) against the sandbox host, and a live key against the production host. A sandbox key sent to the production host (or vice-versa) is rejected with 401. The examples throughout these docs use the sandbox host so you can test immediately; switch the host to compliance.korastratum.com when you go live.

Sandbox keys operate on test data; production keys access live watchlist data.

Response Headers

Every API response includes these headers for debugging and tracking:

Header	Description
X-Request-ID	Unique identifier for the request — include this in support tickets
X-RateLimit-Limit	Maximum requests allowed per minute
X-RateLimit-Remaining	Requests remaining in the current window
X-RateLimit-Reset	Unix timestamp when the rate limit resets

Rate Limits

Rate limits depend on your subscription tier:

Tier	Requests/min	Description
Standard	100	Default tier
Professional	1,000	For higher-volume use cases
Enterprise	10,000	Custom limits available

When you exceed the rate limit, the API returns a 429 status code:

{
  "code": "RATE_LIMITED",
  "message": "Rate limit exceeded. Retry after 2025-06-01T12:00:30Z",
  "request_id": "req_abc123"
}

See Rate Limits for backoff strategies and best practices.

Security

All API communication uses HTTPS. The API enforces these security headers on every response:

• Strict-Transport-Security: max-age=31536000 — HSTS enabled
• X-Content-Type-Options: nosniff
• X-Frame-Options: DENY
• Cache-Control: no-store — no response caching

warning

Never expose your API key in client-side code. All API calls should originate from your backend server.