Authentication

Every request requires an organization API key. Keys are minted in the AI Underwriter dashboard and look like kita_uw_<random>. The key is shown once and stored by Kita only as a SHA-256 hash.

Either header form works:

Authorization: ApiKey kita_uw_xxxxxxxxxxxx
Authorization: Bearer kita_uw_xxxxxxxxxxxx

Scopes

Keys carry read and/or write scopes. GET endpoints require read; mutations require write.

A key missing the scope an endpoint needs gets a 403:

{ "message": "This API key lacks the 'write' scope required for this endpoint." }

Two authentication boundaries

Lender routes under /api/v1 use a member-bound organization API key. Borrower routes under /api/borrower/v1 use short-lived borrower bearer tokens and expose only borrower-safe application data.