Set up API access

Set up API access

Give an external tool or integration read access to a college’s public catalog
data over the kenii/v1 REST API.

Generate an API key

API key management is restricted to a WordPress Administrator account
(manage_options); a Catalog Editor account cannot see this screen.

1. Sign in as a WordPress administrator and open the Kenii admin.
2. Go to Settings → API Access.
3. Enter a label for the key (for example, the name of the integration) in the
   Key label field.
4. Click Generate Key.
5. Copy the key immediately from the reveal box. It is shown once; Kenii stores
   only its hash and cannot show it to you again.

Read data with the key

Send the key on every request as the X-Kenii-API-Key header:

curl -H "X-Kenii-API-Key: YOUR_KEY" 
  https://your-college.edu/wp-json/kenii/v1/api/programs

The key authorizes GET requests against the public read routes: programs,
credentials, courses, catalog years, terms, associations, articulations, settings,
the dashboard summary, and export. See the
REST API reference for the full route list.

If you’re calling the API from server-side code that’s already authenticated as a
WordPress user with catalog access (kenii_manage_catalog or manage_options),
you don’t need a key for reads: a logged-in session authorizes the same routes.

Writes require an administrator session, not just a key

Creating, updating, or deleting programs, credentials, courses, terms, or catalog
years through the API (POST/DELETE on those routes) is not authorized by an API
key at all. Those routes only accept a logged-in WordPress session belonging to a
user with manage_options, a full administrator. This is the one place in Kenii
where a Catalog Editor account, and an API key on its own, are both insufficient;
the caller must be authenticated as an administrator.

Revoke a key

Go to Settings → API Access, find the key by its label and prefix in the list,
and click Delete. Any integration still using that key immediately loses
access.