Public REST API

Steps

1. Navigate to Settings > API Keys
2. Click Create API Key
3. Enter name, select scopes, set expiration
4. Copy generated key
5. Verify key in list
6. Revoke the key

Verify (7 checks)

• API key creation UI works correctly
• Full key shown only at creation time
• Key prefix visible in list (e.g., fov_abc...)
• Maximum 25 active keys enforced
• Key revocation works (soft delete)
• Revoked keys cannot be used for API calls
• Splunk logs show key creation and revocation

Steps

1. List documents via API
2. Get single document
3. Update document
4. List share links
5. Create share link
6. Get analytics

Verify (6 checks)

• All endpoints return proper JSON with { data, meta } structure
• Scope enforcement works (documents:read cannot write)
• Ownership verification prevents access to other users documents
• Cursor-based pagination works correctly
• Expired API keys return 401
• Revoked API keys return 401

Steps

1. Open the share link in a private window, sign the NDA, page through the document
2. GET /api/v1/activity with the API key
3. Repeat with since=<timestamp before step 1>&limit=5
4. Repeat with since=yesterday, and with a documents:read-only key

Verify (7 checks)

• Response is { data: { counts, views, ndaSignatures, topDocuments }, meta: { since, limit } }
• The new view and NDA signature appear newest first with document title and link name
• counts.liveViewers is 1 while the viewer is open and 0 about 30s after closing
• NDA entries carry no signature image, agreement text or signer IP
• Only the caller’s own documents appear
• Invalid since returns 400; key without analytics:read returns 403
• Fovea Omarchy widget badge counts the new view + NDA and clears on opening its popup