Authentication

Every request carries an API key in the Waygo-API-Key header. A key belongs to an account and has a set of scopes: what it may do.

Keys are created through the API keys endpoint by a user of the account, or by your Waygo team. Keep keys with write scopes on your servers; a key that goes into a web page or an app should carry only the read scopes the map needs.

Authenticated request

curl https://api.waygomaps.com/catalogs/v1 \
  -H "Waygo-API-Key: wg_live_hSIhXBhNe8X1d8Et…"

Requests are HTTPS only. A missing, revoked or under-scoped key answers 403 with a message naming the scope the endpoint needs.

Acting on a sub-account

A key works for its own account and for every sub-account of it. To act on a sub-account, add its ID in the Waygo-Account header; without the header the request applies to the key's own account.

A sub-account's catalogs

curl https://api.waygomaps.com/catalogs/v1 \
  -H "Waygo-API-Key: wg_live_hSIhXBhNe8X1d8Et…" \
  -H "Waygo-Account: acme-events-emea"

Scopes

Each endpoint names the scope it needs (resource:action). A key can only hold scopes its creator has, and only scopes the account's plan allows.

Scope family	Covers
`catalogs:read` · `catalogs:write` · `catalogs:delete`	Catalogs
`content:read` · `content:write` · `content:delete`	Content
`maps:read` · `maps:write`	Maps, Links, Kiosks
`floor-plan-uploads:read` · `floor-plan-uploads:write` · `floor-plan-uploads:delete`	Floor plans
`search:read` · `routes:read`	Search and directions
`map-views:read`	Reading a map's views
`accounts:read` · `accounts:write` · `accounts:delete`	Accounts and sub-accounts
`api-keys:read` · `api-keys:write` · `api-keys:delete`	API keys
`users:read` · `users:write`	Users of an account

Keys you create yourself can carry the account, user, API-key, catalog, content and map-view scopes. Keys for maps, links, kiosks, floor plans, search and directions are issued by your Waygo team with exactly the scopes your integration needs; ask for one and say which endpoints you will call.

Roles

Users sign in to the dashboard with a role on each account: Owner, Admin, Editor or Viewer (see Sub-accounts and users). A user can only create API keys with scopes their own role grants: an Editor can create catalog and content keys but cannot revoke keys; a Viewer can create none.