Authentication

Every request carries Authorization: Bearer <credential>.

• API keys (dlp_live_…) are created in the console at Developer → API keys. A key can be scoped to individual use cases (dataquality.<usecase>.single / .batch), given a credit ceiling per day, week or month, and an expiry — 365 days by default, and any value from 1 to 730 days; a key cannot be made never to expire. Keys are revealed, renamed, re-scoped, rotated and revoked from the same page. A call outside a key's scopes is refused with 403. A key is a secret credential with the same reach as a password: it belongs on a server, and a key placed in client-side code is a disclosed key.

• Rotating or revoking a key takes effect at once, with no overlap window. A rotation issues a new secret on the same key and invalidates the old one in the same step, so deploy the new secret before you rotate rather than after; a revocation invalidates the key outright. In both cases the credential stops being accepted immediately, with one bounded exception: an authorization decision already made for that credential is cached by the gateway for up to 60 seconds, so a request in flight within that window can still be served. Nothing is cached beyond it.

• OAuth 2.0 client credentials (machine-to-machine) is also accepted; see the oauth2 security scheme for the token endpoints.

Security schemes

apiKey

Type: http · HTTP scheme: bearer · Bearer format: dlp_

Native Delpha API key. Send it as an HTTP bearer token (Authorization: Bearer dlp_...). Keys are issued from the Delpha app (Developer → API keys) and are billed per team against the team's credit balance.

oauth2

Type: oauth2 · Flow: clientCredentials · Token URL: https://secure.delpha.io/oauth2/token · Scope: api/access — Access to the public API

OAuth 2.0 client-credentials flow (machine-to-machine). Token URL: https://secure.delpha.io/oauth2/token. The api/access scope is all-access: it grants every operation this document publishes. Per-use-case scoping, per-key credit ceilings and expiry are properties of an API key, not of this flow — use an API key when a credential must be restricted.

API-key scopes

A key with no scopes has full access. A scoped key is restricted to the use cases listed on it, one scope per row below: single covers the use case's submit operation, its poll operation and its synchronous route where it has one; batch covers the batch submit and batch poll pair. A call outside a key's scopes is refused with 403.

Use case	Single scope	Batch scope	State
email	dataquality.email.single	dataquality.email.batch	current
website	dataquality.website.single	dataquality.website.batch	current
phone	dataquality.phone.single	dataquality.phone.batch	current
name	dataquality.name.single	dataquality.name.batch	current
legal-id	dataquality.legal-id.single	dataquality.legal-id.batch	current
linkedin-profile	dataquality.linkedin-profile.single	dataquality.linkedin-profile.batch	current
linkedin-company-page	dataquality.linkedin-company-page.single	dataquality.linkedin-company-page.batch	current
ultimate	dataquality.ultimate.single	dataquality.ultimate.batch	current
company	dataquality.company.single	—	current

Scopes, the credit ceiling and the expiry are chosen when the key is created and can be changed afterwards from Developer → API keys.