---
title: V1 APIs
slug: generic-onboarding/v1-apis
createdAt: 2025-07-25T07:19:46.527Z
---

## Overview

This guide provides instructions to create, manage, and use **JWT-based API keys **from the **GO Admin Portal**, as well as a categorized reference of all supported API endpoints.

You will need to follow this to use any of the GO APIs.

## Location in Portal

In the GO Admin Portal, navigate to:

**Grants & Config > Create API Keys**

You will see a screen with a Create New button to begin generating a new API key. There, you will find the interface to manage API keys for different API categories. You can also see list of past generated keys for your reference along with information like rate limits and expiry.

## Creating an API Key

Follow these steps to generate a new API key:

1. Click on the **Create New** button.
2. Enter a recognizable **name** for the API key.
3. Use toggles to select the required **API categories**:
   - Auth User Management
   - RMS Management
   - Backops User Management
   - Merchant Management
   - Merchant Misc
   - App Specific Data
   - UAM Audit Data
   - Lead Management
4. Define the **expiry date and time**.
5. Set a **rate limit** between 1 and 10,000 requests per minute.
6. Click **Create**. The JWT token will be shown only once. Copy and store it securely.

## Token Visibility and Storage

:::hint{type="warning"}
The platform does not allow retrieval of the token after generation for security measures.
:::

- The token is visible only once — at the time of creation.
- Ensure secure storage of the token, such as in a password manager or internal key vault.
- Treat this token like a password; do not expose it in frontend code, logs, or public spaces.

## Using the Token in API Calls

Authorization: \<token>
Content-Type: application/json

Example CURL request:

```json
curl --location '/api/v1/backopsusers/checkUsernameExist' \
--header 'Content-Type: application/json' \
--header 'Authorization: <token>' \
--data '{
  "realm": "demo",
  "username": "sampleUser",
  "caseInsensitive": true
}'
```

## API Categories and Endpoints

Below is a categorized list of supported API endpoints accessible via /api/v1/.

### Auth User Management

- /backopsusers/checkUsernameExist
- /backopsusers/reset-password

### RMS Management

- /rms/checkManagerCodeExist
- /rms/reset-password
- /applications/&#x7B;applicationId}/rms (GET / POST)
- /applications/&#x7B;applicationId}/rms/&#x7B;rmsId} (GET / PATCH)

### Backops User Management

- /applications/&#x7B;applicationId}/backopsusers (GET / POST)
- /applications/&#x7B;applicationId}/backopsusers/&#x7B;bId} (PATCH)
- /applications/&#x7B;applicationId}/backopsusers/&#x7B;bId}/&#x7B;uId} (DELETE)

### Merchant Management

- /merchants/&#x7B;merchantId}/data (GET)
- /applications/&#x7B;applicationId}/merchants (POST)
- /applications/&#x7B;applicationId}/merchants/&#x7B;mId}/&#x7B;bId} (PUT)

### Merchant Misc

- /merchants/workflow (POST)
- /merchants/&#x7B;merchantId}/customIntegrationLogs (GET)
- /merchants/data (POST / DELETE)

### App Specific Data

- /applications/&#x7B;applicationId}/allRegionBucketsOfApplication (GET)

UAM Audit Data

- /uamauditdata/rm/getData (POST)
- /uamauditdata/getData (POST)
- /uamauditdata (GET)

Lead Management

- /leads/&#x7B;rmId} (GET / POST)

## Best Practices

- Never share your JWT token publicly
- Scope tokens only to the categories you need
- Rotate tokens periodically — before expiry
- Always use https\:// for all API interactions
- Avoid embedding tokens in frontend code
- Monitor and enforce rate limits to prevent abuse