Trustradius Authentication

generated: '2026-08-14'
method: searched
source: >-
  https://apidocs.trustradius.com/docs/public-api/ZG9jOjQ1Mg-trust-radius-api (auth section),
  https://trustradius.freshdesk.com/support/solutions/articles/43000639047 (key retrieval),
  openapi/_original/trustradius-api-openapi.yml (securitySchemes)
docs: https://apidocs.trustradius.com/docs/public-api/ZG9jOjQ1Mg-trust-radius-api
provider: TrustRadius
providerId: trustradius
description: >-
  One authentication model: a single opaque API key, sent in the lowercase `x-api-key` HTTP header,
  issued per vendor account. There is no OAuth surface, no OIDC discovery, no scope model, no token
  exchange, no refresh, and no documented rotation or expiry policy. The key is the whole security
  contract.
summary:
  types:
    - apiKey
  api_key_in:
    - header
  oauth2: false
  oidc: false
  mtls: false
  scopes: false
schemes:
  - name: x-api-key
    type: apiKey
    in: header
    parameter: x-api-key
    case_sensitive: true
    description: >-
      All API calls must send an API key in the "x-api-key" HTTP header. TrustRadius clients can get
      their key from their Client Success Manager.
    applied_to: all 11 published operations
    declared_at: operation level only
    declared_at_note: >-
      The published spec repeats `security: [{x-api-key: []}]` on each operation and declares no
      root-level `security` block, so a generator that reads only the document root will treat the
      API as unauthenticated.
    sources:
      - openapi/_original/trustradius-api-openapi.yml
      - openapi/trustradius-intent-data-api-openapi.yml
      - openapi/trustradius-legacy-api-openapi.yml
      - openapi/trustradius-product-data-api-openapi.yml
      - openapi/trustradius-traffic-data-api-openapi.yml
      - openapi/trustradius-trustquotes-api-openapi.yml
credential_issuance:
  self_serve: false
  paths:
    - name: Vendor Portal
      steps: Log in to the TrustRadius Vendor Portal > Integrations > "Get API key" > copy to clipboard.
      url: https://trustradius.freshdesk.com/support/solutions/articles/43000639047
    - name: Client Success Manager
      steps: Ask your assigned TrustRadius CSM, or email product@trustradius.com.
      url: https://apidocs.trustradius.com/docs/public-api/ZG9jOjQ1Mg-trust-radius-api
  prerequisite: >-
    A paid vendor subscription. There is no free tier, trial key, or developer signup — see plans/.
  entitlement_note: >-
    A valid key does not imply access to every endpoint. Which paths return data depends on the
    package elements the vendor account holds (content licensing, visitor insights, category intent
    data). A key without the relevant entitlement is denied with the same 403 as an invalid key.
transport:
  https_only: true
  quote: All API access is over HTTPS at https://api.trustradius.com/v1
  example: "curl -H 'x-api-key:VENDOR_AUTH_KEY' https://api.trustradius.com/v1"
failure_modes:
  - status: 403
    body: '{"message":"Forbidden"}'
    causes:
      - Missing x-api-key header.
      - Invalid or revoked key.
      - Vendor account not entitled to the requested path.
    note: >-
      The same status and body cover all three causes, so a client cannot tell a credential problem
      from an entitlement problem from the response.
gaps:
  - No key rotation, expiry, or revocation policy is published.
  - No scope or least-privilege model — one key grants everything the account is entitled to.
  - No 401 is declared or observed; the edge answers 403 for unauthenticated requests.
  - No /.well-known/oauth-authorization-server or /.well-known/openid-configuration on any host.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com