Read an API owner account

Read shared limits, quota balances, usage, keys and private activity.

GET/v1/developer/accounts/{n}

Access: Signed request
Client: Local or server client

Parameters#

Name	Location	Meaning
`n`Required	Path	Permanent number of the person or organisation that owns the allowance.

Send the common signed-request headers, including X-Nonce and X-Timestamp. A signed GET has no JSON body. Request signing

Request examples#

cURL

curl -fsS \
  -H "X-Public-Key: $PUBLIC_KEY" -H "X-Signature: $REQUEST_SIGNATURE" \
  -H "X-Nonce: $NONCE" -H "X-Timestamp: $TIMESTAMP" \
  "https://veil.rip/v1/developer/accounts/1"

Response#

HTTP 200application/json

owner, suspended, limits, quota, usage, history, keys, next, audit and permissions. History covers the latest 31 days. The initial key page has at most 50 rows and the audit has at most 20.

Field	Type	Meaning
`owner`	`integer`	Permanent owner card number.
`suspended`	`boolean`	Whether the entire API account is suspended.
`limits`	`object`	requestsPerMinute, verificationPerMinute and optional dailyLimit.
`quota`	`Quota`	Current shared and additional balances.
`usage`	`Usage`	Current UTC-day usage.
`history`	`array<Usage>`	Daily rows for the latest 31 days.
`keys`	`array<ApiKey>`	First page of at most 50 key metadata rows.
`next`	`integer \| null`	Pass as before to the keys endpoint for older keys.
`audit`	`AuditPage`	Newest private receipts, at most 20 initially.
`permissions`	`array<string>`	Actions the current signed caller may perform.

Expand a nested object for its fields. Types ending in null allow a null value; optional fields may be absent. Other fields are present in that object.

API key metadata ApiKey

Field	Type	Meaning
`id`	`string`	Public key-management ID, not the bearer secret.
`owner`	`integer`	Permanent owner card number.
`label`	`string`	Integration label supplied by its owner.
`prefix`	`string`	Non-secret display prefix.
`scopes`	`array<string>`	read and/or verify.
`state`	`string`	active, expired, suspended or revoked. Account suspension is reported separately.
`createdAt`	`string`	Creation time in ISO 8601 UTC.
`expiresAt`	`string`	Expiry time in ISO 8601 UTC.
`revokedAt`	`string \| null`	Permanent revocation time.
`suspended`	`boolean`	Whether this key is suspended.
`requestsPerMinute`	`integer \| null`	Additional per-key cap, or null.
`lastUsedAt`	`string \| null`	Last admitted use, or null if never used.
`requests`	`integer`	Lifetime admitted requests for this key.

Shared and additional quotas Quota

Field	Type	Meaning
`requests`	`Bucket`	Owner’s shared request bucket.
`verification`	`Bucket`	Additional shared verification bucket. Verification consumes both buckets.
`daily`	`Bucket \| null`	Additional daily cap, if set.
`key`	`Bucket \| null`	Additional per-key cap, if set.

Quota bucket Bucket

Field	Type	Meaning
`limit`	`integer`	Bucket capacity, or the UTC-day cap for a daily bucket.
`remaining`	`integer`	Whole requests currently available.
`resetAt`	`integer`	Unix seconds when the bucket will be full, or the next UTC midnight for a daily cap.

UTC-day usage Usage

Field	Type	Meaning
`day`	`string`	UTC date in YYYY-MM-DD format.
`requests`	`integer`	Admitted requests during the day.
`verifications`	`integer`	Admitted verifications; included in requests.
`rejected`	`integer`	Rejected quota admissions during the day.

Private receipt page AuditPage

Field	Type	Meaning
`owner`	`integer`	Owner card number.
`events`	`array<AuditEvent>`	Newest receipts first.
`next`	`integer \| null`	Pass as before to read older receipts. Null ends pagination.

Private management receipt AuditEvent

Field	Type	Meaning
`id`	`integer`	Receipt cursor.
`owner`	`integer`	Permanent owner card number.
`keyId`	`string \| null`	Affected key, or null for an account change.
`actor`	`integer`	Card that signed the management request.
`action`	`string`	Management action, such as create, revoke or account_limits.
`reason`	`string`	Staff reason, or an empty string for an owner action.
`details`	`object`	Action-specific metadata, including before/after values for limit changes. Never contains the bearer secret.
`proof`	`object`	Exact method, path, body, public key, alg and signature of the signed request.
`createdAt`	`string`	Receipt time in ISO 8601 UTC.

Response headers#

Header	Value	Meaning
`Content-Type`	`application/json`	Use the declared media type before choosing a parser.
`Date`	`HTTP date`	Server time. Compare it with your clock when signing requests.
`Cache-Control`	`no-store`	Do not persist private or temporary responses in a shared cache.
`Retry-After`	`integer seconds, on rate_limited or busy`	Wait at least this long before retrying. Other 429/503 codes do not necessarily include it.

Usage notes#

The owner signs with an active device key. Organisation management requires an accepted owner. Bearer API keys cannot authorise this call.
The response is private and uses Cache-Control no-store.
Management writes accept at most 8 KiB and reject unknown body fields. nonce and timestamp are the common signing fields.

Errors#

API errors return an error object. Use error.code for program logic; error.message is English text for people and can change. Response and error guide

HTTP	Code	Meaning and next step
400	`invalid_parameter`	A path, query or body field is missing, malformed or outside its accepted range. Correct the field named in `error.message` before sending again.
403	`identity_banned`	The acting identity is suspended by Veil staff. Wait for the restriction to end or ask staff to review it.
403	`key_mismatch`	The signing key does not have authority over this card or operation. Use an active device key with the required owner or member role.
404	`not_found`	The requested card, key, alias, code or resource was not found. Check the identifier. Temporary codes and previews may already have expired or been used.

Shared request errors

HTTP	Code	Meaning and next step
400	`invalid_nonce`	The signed-request nonce has an invalid format. Generate a fresh 16 to 128-character nonce using letters, digits, _ or -.
400	`invalid_signature_alg`	`X-Signature-Alg` is unsupported. Use a supported signing algorithm and matching key/signature encoding.
400	`invalid_timestamp`	The signed-request timestamp is not Unix milliseconds. Use an integer Unix timestamp in milliseconds and sign the corrected request.
401	`invalid_signature`	The HTTP request signature does not verify. Sign the exact method, path and body bytes, without changing them afterwards.
401	`missing_signature`	The request requires a device signature and its headers are missing or unreadable. Send `X-Public-Key`, `X-Signature` and the signed-request metadata. An API key does not replace a device signature.
401	`stale_timestamp`	The signed timestamp is outside the accepted clock window. Compare the server Date header with your clock, then generate a fresh nonce, timestamp and signature.
403	`key_banned`	The device signing key is suspended by Veil staff. Use an authorised active key or ask staff to review the restriction.
409	`replayed_nonce`	The signing key already used this nonce. Check whether the previous request succeeded before making a fresh signed request.
429	`rate_limited`	An anonymous, signed-request or API-key allowance was exceeded. Wait at least `Retry-After` seconds. Share a queue and retry budget across your workers.
500	`internal_error`	An unexpected server error occurred. Internal details are not returned. Retry reads with bounded backoff. Check write results before sending a new signed operation.
503	`busy`	The application has reached a temporary concurrency or database limit. Wait `Retry-After` seconds and retry with bounded backoff.

Read this entry as JSON