Ce guide n’est pas encore traduit dans votre langue.
Every API call is authenticated with an API token sent as a bearer credential. This page explains the token types, the scopes and the endpoints that manage tokens.
Sending the token
GET /api/documents HTTP/1.1
Host: api.legalcloud.info
Authorization: Bearer lc_...Tokens are created in the dashboard (Organization → API) — see Generating API tokens — or through the endpoints below.
Token types
| Type | Use |
|---|---|
application | Calls the API within its scopes. |
document | Opens a single document on /d/{hash}; it cannot call any other endpoint. |
Scopes
Every endpoint lists the scope it requires. An application token carries all the permissions of the member who created it, or a narrower list:
documents:read, documents:write, sites:read, sites:write, resources:read, resources:write, organization:read, organization:write.
A request without the required scope is rejected with 403 and "code": "SCOPE_FORBIDDEN".
Token endpoints
These endpoints require the organization:read or organization:write scope.
| Method | Path | Description |
|---|---|---|
GET | /api/account/tokens | List the tokens of your organization |
POST | /api/account/tokens | Create a token |
DELETE | /api/account/tokens/{id} | Revoke a token |
DELETE | /api/account/tokens/{id}/permanent | Delete a revoked token permanently |
POST | /api/account/tokens/{id}/regenerate | Revoke a token and create a new one with the same label and expiry |
POST | /api/account/tokens/{id}/reveal | Reveal the plain token (owner) |
GET | /api/account/api-usage | Quota and 30-day usage |
GET | /api/account/api-usage/calls | Log of recent API calls |
Create a token
curl -X POST https://api.legalcloud.info/api/account/tokens \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"label": "marketing-site-prod",
"type": "application",
"scopes": ["documents:read"],
"expiresAt": "2027-01-01T00:00:00Z"
}'The response contains the new token. For a document token pass "type": "document" and "documentId".
Regenerate a token
curl -X POST https://api.legalcloud.info/api/account/tokens/{id}/regenerate \
-H "Authorization: Bearer YOUR_TOKEN"The old token stops working immediately and the response carries the new one.
Token errors
| Status | code | Meaning |
|---|---|---|
| 401 | TOKEN_MISSING | No token was sent |
| 401 | TOKEN_INVALID | The token does not exist |
| 401 | TOKEN_REVOKED | The token was revoked |
| 401 | TOKEN_EXPIRED | The token passed its expiry date |
| 403 | SCOPE_FORBIDDEN | The token lacks the required scope |
Security
- Keep application tokens on your server; never ship them in browser code.
- Use the narrowest scopes and an expiry date when possible.
- Regenerate a token immediately if you suspect a leak.