Authentication

How callers authenticate against the Cinch backend Core REST API.

API key header

Every Core API service (Contour.Core.Api.*) is secured with ASP.NET Core authentication. Requests supply an API key in the CDS-ApiKey request header. The per-service BasicAuthenticationHandler reads that header and resolves the caller via CloudUserProfileEntity.LoadByApiKey(...). Controllers are decorated [Authorize]; only health/warmup endpoints are [AllowAnonymous].

Header

CDS-ApiKey: <your-api-key>

Base URL

Services are fronted by (per-domain ports are assigned outside the repository). Treat as the gateway; service routes are namespaced under /api/<service>/....

Example

curl -X GET "/api/veeam/tenants" \
  -H 'CDS-ApiKey: $CINCH_API_KEY' \
  -H 'Accept: application/json'

Errors

Unauthenticated or unauthorized requests return standard HTTP status codes:

Status	Meaning
401	Missing or invalid API key.
403	Authenticated, but the caller lacks permission for the resource.
404	Resource not found.
429	Rate limit exceeded.
500	Server error — retry with backoff.