Push Security Partner API (v1)
The Push Security Partner API provides programmatic access to the tenants you manage as a Push partner. It lets you drive tenant lifecycle from your own systems rather than through the partner console.
This API adheres to RESTful principles, featuring resource-oriented URLs that are predictable and easy to navigate. It uses JSON-formatted request bodies and responses along with standard HTTP response codes, authentication methods, and HTTP verbs.
Every operation is scoped to the partner the API key belongs to. A tenant managed by another partner is indistinguishable from one that does not exist.
Rate limits are in place to ensure consistent performance for all partners.
To interact with the Push Security Partner API, you'll need a partner API key for authentication. To create or manage your partner API keys, go to the API keys page in the Push partner console.
Partner API keys are prefixed with pspk_. They are distinct from the tenant API keys used with the Push Security REST API, which are prefixed with psak_, and the two are not interchangeable.
When generating a new key, you have two permission levels to choose from: Read only and Full access. A Read only key can make GET requests only — listing tenants, reading a tenant and listing a tenant's API keys. Creating, updating or deleting a tenant, and generating a SAML setup link, all require a Full access key.
To authenticate your API requests, include a header named x-api-key and set its value to your partner API key.
All API calls must be made over HTTPS.
Each Push region is independent: a tenant exists in one region, and a partner API key authenticates only against the region it was issued in. Use the server for the region your tenants are in.
Deleting or disabling a partner API key, and removing a partner's access to the Partner API, all take effect within 10 minutes rather than immediately. Authorization decisions are cached for that period. Plan key rotation around that window.
The Push Security Partner API enforces rate limiting to ensure equitable access and maintain performance.
Limits apply per API key, not per partner, so each key you issue gets its own allowance:
| Limit | Value |
|---|---|
| Requests per second | 10, with a temporary burst capacity of an additional 10 for brief intervals |
| Requests per day | 5,000 |
If you surpass the rate limit, the API returns a 429 status code. If you exhaust the daily quota, further requests are rejected until the quota resets.
The Push Security Partner API uses standard HTTP response codes to signal the outcome of an API call. Here's what you need to know:
2xx codes: These indicate that your request was successful.
4xx codes: A client-side issue, usually because something is missing or incorrect in your request.
5xx codes: These suggest a problem on our end, although these occurrences are infrequent.
| HTTP Code | Description |
|---|---|
| 200 OK | Your request was successfully processed. |
| 400 Bad Request | Your request is missing something or is incorrect. Double-check your parameters. |
| 403 Forbidden | Your partner account does not have access to the Partner API, the key is unknown or disabled, or you used a Read only key on a write operation. |
| 404 Not Found | The tenant does not exist or is not managed by your partner account, or the tenant's API key does not exist. |
| 409 Conflict | The tenant is being deleted (TENANT_DELETE_IN_PROGRESS), already has 20 API keys (TOO_MANY_API_KEYS), or already has a SAML connection (CONNECTION_ALREADY_EXISTS). |
| 429 Too Many Requests | You've exceeded the rate limits or the daily quota. Consider implementing exponential backoffs in your API calls. |
| 500 Server Error | Something's not right on our end. |
| 502 Bad Gateway | A tenant's sign-in could not be provisioned or updated, or its SAML setup link could not be created. Nothing was changed, so the request can be retried. |
| 503 Service Unavailable | The API is temporarily down for maintenance. Retry later. |