Information
- OpenAPI version:
3.0.3
Overview
Signals DPG API 1.0.0
Section titled “Signals DPG API 1.0.0”Network-aware Signals DPG API — items, actions, events, consent, network fetch, admin.
Unless marked otherwise, operations require authentication via either the apiKeyAuth or sessionAuth scheme (the spec default). Public operations carry no Authorizations section; the two inter-instance *_local operations use the service-to-service peerAuth scheme instead. Admin and aggregator operations additionally require the x-acting-org-id header (optional on action operations). See docs/operations/integrating-dpgs.md for the full auth model.
Authentication
Section titled “Authentication”apiKeyAuth
Section titled “apiKeyAuth”Service API key used by integrating DPGs (aggregator-dpg, voice-dpg) and other machine clients (apps/api/plugins/auth/validate_api_key.ts). Takes priority over session auth: if present and invalid the request is rejected outright, with no fallback to a session. Routes under /api/v1/admin and /api/v1/aggregator additionally require an x-acting-org-id header identifying the organization the request acts on behalf of — see docs/operations/integrating-dpgs.md.
Security scheme type: apiKey
Header parameter name: x-api-key
sessionAuth
Section titled “sessionAuth”Browser session cookie issued by better-auth after sign-in, used by the web UI (apps/api/plugins/auth/validate_session.ts). Checked as a fallback only when x-api-key is absent.
Security scheme type: apiKey
Cookie parameter name: better-auth.session_token
peerAuth
Section titled “peerAuth”Inter-instance HMAC token (paired with an x-instance-timestamp header), used only by peer Signals instances for the network *_local operations (src/middleware/peer_instance_guard.ts). Not for external callers.
Security scheme type: apiKey
Header parameter name: x-instance-token