Quick Start

Once you have an API key and secret, the recommended first call is GET /v1/account. It is not billed against any product, works for every active key, and returns the account environment, products and current balance. This lets you confirm three things before going any further: that your credentials work, that you are pointed at the expected environment, and that the products you intend to use are enabled.

1. Make your first call

curl -H "Authorization: Bearer <your-api-key>|<your-api-secret>" \
     https://portal.watcheye.com.au/api/v1/account

A successful response looks like:

{
  "data": {
    "uuid": "7a1f0c8e-2b9f-4f0e-8d1a-1e2b3c4d5e6f",
    "account_name": "Sample Account",
    "environment": "live",
    "balance": "1234.5678",
    "credit_limit": "100.0000",
    "available_credit": "1334.5678",
    "products": [
      { "name": "pep_sanction_check", "label": "PEP and Sanction Check" }
    ]
  },
  "api_reference": "9a4b1c8e-2f63-4f9a-9f3a-9b1f5a7c2d4f"
}

If you get 401 Unauthorized, double-check the Authorization header format (Bearer <key>|<secret>, separated by a pipe character) and that any IP restrictions on the key include the address you are calling from. See Common error responses for the 401 messages.

2. Confirm the environment

data.environment is either live or sandbox. Calls made with a key on a sandbox account are not billed; calls made with a key on a live account are. Sandbox and live are separate accounts with separate keys - see Sandbox for how to use them in your integration test cycle.

3. Confirm your product entitlements

Each entry in data.products is a billable operation your account is entitled to call. If you intend to run PEP & Sanction checks, look for pep_sanction_check; for business screening, look for business_check; for identity verification, look for the per-document-type entries you need. A missing entry typically surfaces later as 403 No access on the corresponding launch endpoint - resolve it with your Global Data account manager before continuing.

4. Where to go next

Common follow-on calls for a new integration:

• List your programs: GET /v1/programs
• Create your first entity: POST /v1/programs/{program_uuid}/entities
• Launch a screening check against the entity: POST /v1/entities/{entity_uuid}/checks
• Poll the check result: GET /v1/checks/{check_uuid}
• Review the audit log of every API call you have made: GET /v1/audits

Before you write code against these, skim API Conventions and List Endpoint Conventions - they describe the field-naming, pagination, filter and sort rules that apply uniformly to every endpoint, so each operation's reference only has to describe what is specific to it.