# Getting started

The FortWatch API gives your own scripts and tools the same data you see in the dashboard: your assets, scans, issues, reports and audit log. It is a REST API that speaks JSON over HTTPS, at:

```text
https://api.fortwatch.ai
```

## 1. Create an API key

In FortWatch, open **Settings → API access → API keys** ([open it](https://app.fortwatch.ai/settings/api)) and choose **Create key**. Only owners and admins can create keys, and only with two-factor authentication turned on: you confirm with a code from your authenticator app.

Give the key a name (the tool that will use it), the access it needs per area (no access, read, or read & write) and how long it lives (30 days, 90 days or 1 year). The key is shown **once**: copy it into your password manager or your CI's secret store.

## 2. Make a request

Send the key as a bearer token in the `Authorization` header:

```bash
export FORTWATCH_API_KEY="fwk_…"
curl https://api.fortwatch.ai/app/assets \
  -H "Authorization: Bearer $FORTWATCH_API_KEY"
```

The answer is a JSON array of your assets. The response headers say how many there are (`X-Total-Count`) and how much of your request budget is left (`RateLimit-Remaining`).

## 3. Go further

- [Authentication](/authentication): what a key can and cannot do, and how to rotate one.
- [OAuth apps](/oauth): when another product connects to FortWatch, or a tool wants a client ID and secret.
- [Limits and paging](/limits): request budgets and how lists are paged.
- [Errors](/errors): the shape of an error and every code.
- [API reference](/api): every endpoint, with examples in curl, Node.js, Python and Go.

> Everything a key changes appears in your audit log as "<you> via API key ‘<name>’", so you can always see what your scripts did.