> ## Documentation Index
> Fetch the complete documentation index at: https://platform.doodocs.kz/llms.txt
> Use this file to discover all available pages before exploring further.

# Environments

> Base URL, enabling the API for a tenant, and verifying a key

## Base URL

```
https://app.doodocs.kz/api/developer/v1
```

Every path in this reference is relative to it. Authentication is the `X-API-Key`
header; there is no tenant header, because the key itself identifies the tenant.

<Note>
  There is no separate sandbox environment. Debug your integration against your own
  tenant — create a few test employees and draft documents for that purpose.
</Note>

## Enabling it for a tenant

The Developer API sits behind a feature flag. While the flag is off, every request
returns `403` with the code `FEATURE_FLAG.NOT_AVAILABLE`, even with a valid key. Ask
your Doodocs manager to enable it.

The key management screen appears in the same place: Settings → Integrations →
"For developers" → **API**.

## Verifying a key

Before building an integration, confirm the key is accepted. The endpoint returns
nothing but a status and requires no scope.

```bash theme={null}
curl https://app.doodocs.kz/api/developer/v1/api_key/_verify \
  -H "X-API-Key: $DOODOCS_API_KEY"
```

```json theme={null}
{}
```

| Response | What it means                                                                     |
| -------- | --------------------------------------------------------------------------------- |
| `200`    | The key is active, the tenant resolved, the flag is on                            |
| `401`    | The key is missing, revoked, or unknown; or its owner was removed from the tenant |
| `403`    | The key is valid, but the Developer API is not enabled for the tenant             |

## Environment limits

* Rate: 10 requests per second per key, bursting to 20. See
  [Limits](/en/api-reference/limits).
* There is a single version, `v1`. Compatibility rules live in
  [Conventions](/en/api-reference/conventions).
* Outbound calls (webhooks) go only to `https` and only to public addresses — see
  [Security](/en/api-reference/security).