Site keys · spamex

All endpoints on this page take a platform key. A site key calling them receives 403. Site keys belong to the platform key that created them; another platform’s site keys are invisible (404).

Every response describing a site key has this shape. The key itself appears only in the create and rotate responses.

{
  "id": 42,
  "name": "form_8f2a (acme-plumbing.com)",
  "key_prefix": "sk_Ljq2ji7x",
  "revoked": false,
  "quota": 250000,
  "rate_limit": 60,
  "locale": "en",
  "honeypot_field": "website",
  "site_description": "Family-owned plumbing company in Columbus, Ohio.",
  "retain_raw_text": false,
  "created_at": "2026-09-05T09:12:44"
}

Create a site key

POST /v1/partner/keys Platform key

Body

name string required

A label you will recognise, 1 to 120 characters. The form id and domain work well.

quota integer default platform quota

Classifications per month for this form. Defaults to the platform key’s quota. 0 means unlimited.

locale string default "en"

The form’s language. Latin locales treat Cyrillic or CJK text as a soft signal.

honeypot_field string default "honeypot"

Name of the hidden trap field in the customer’s form.

site_description string default ""

One paragraph about the site, up to 2,000 characters. Read by the second-opinion stage for borderline messages.

retain_raw_text boolean default false

Keep full submission text for review. See Data and privacy.

curl -X POST https://api.spamex.dev/v1/partner/keys \
  -H "Authorization: Bearer $PLATFORM_KEY" -H "Content-Type: application/json" \
  -d '{"name": "form_8f2a (acme-plumbing.com)", "site_description": "Family-owned plumbing company in Columbus, Ohio.", "honeypot_field": "website"}'

Returns 201 with the site object plus "key": "sk_…". Store the key encrypted against the form; it is not shown again. The site key inherits the platform key’s rate limit.

List site keys

GET /v1/partner/keys Platform key

curl https://api.spamex.dev/v1/partner/keys -H "Authorization: Bearer $PLATFORM_KEY"

Returns an array of site objects (prefixes only, never keys), including revoked ones, ordered by id.

Update a site key

PATCH /v1/partner/keys/{id} Platform key

Partial update: only the fields present in the body change. Accepts the same fields as create, all optional.

curl -X PATCH https://api.spamex.dev/v1/partner/keys/42 \
  -H "Authorization: Bearer $PLATFORM_KEY" -H "Content-Type: application/json" \
  -d '{"site_description": "Plumbing and heating company in Columbus, Ohio. Customers write in for quotes and emergencies.", "quota": 50000}'

Returns the updated site object.

Rotate a site key

POST /v1/partner/keys/{id}/rotate Platform key

curl -X POST https://api.spamex.dev/v1/partner/keys/42/rotate -H "Authorization: Bearer $PLATFORM_KEY"

Returns the site object plus a new key. The old key stops working immediately. Rotating a revoked key un-revokes it.

Revoke a site key

DELETE /v1/partner/keys/{id} Platform key

curl -X DELETE https://api.spamex.dev/v1/partner/keys/42 -H "Authorization: Bearer $PLATFORM_KEY"

{ "ok": true, "id": 42 }

The key returns 403 from the next request. Its usage history and records are kept; ask us for bulk deletion when a customer’s data must go.