# Postman collection and OpenAPI document

KeenAuth publishes its machine-readable API contract as two files. Both are generated from the public management API definition on every release, so they always match the API reference. Internal operations never appear in them.

| File | Format | Download |
|---|---|---|
| Postman collection | Postman Collection v2.1.0 | [postman_collection.json](/api/postman_collection.json) |
| OpenAPI document | OpenAPI 3.1 | [openapi.json](/api/openapi.json) |

## Import into Postman

1. In Postman, choose **Import** and select the downloaded `postman_collection.json`.
2. Open the collection variables and set `apiKey` to a management API key. Create one in the dashboard or with the CLI; the key is sent as a Bearer token.
3. Set `region` to the region of your environment (`eu` is the default). Requests go to the host `api.{{region}}.keenauth.com`, path `/v1`.
4. Send a request. Every `POST` request carries an `Idempotency-Key` header that Postman fills with a fresh GUID, so a retried request is safe.

Requests are grouped in one folder per API tag. Path parameters such as `{{user_id}}` are collection variables: set them before you send a request that needs them.

## Use the OpenAPI document

The OpenAPI document is the input for code generation and for API gateways, linters and mock servers. The same document is served by the API itself at `https://api.eu.keenauth.com/v1/openapi.json`.

## Contract archive and SDK digests

The OpenAPI document is also published at a content-addressed archive path. The path segment is the SHA-256 of the document bytes, so the file at an archive path never changes:

| File | Content |
|---|---|
| `/openapi/<sha256>/openapi.json` | The document, byte-identical to `/api/openapi.json` of that version |
| `/openapi/<sha256>/openapi.json.sha256` | The digest in `sha256sum` format |
| [`/openapi/index.json`](/openapi/index.json) | The archived documents: `sha256`, `info_version`, `path`; `current` marks the latest |

Each server SDK records the digest of the document it was generated from:

| SDK | Where |
|---|---|
| Node.js (`@keenauth/node`) | `OPENAPI_SHA256` export and `keenauth.openapiSha256` in `package.json` |
| Python (`keenauth-python`) | `keenauth.OPENAPI_SHA256` and the `OpenAPI document` project URL in the package metadata |
| Go | `keenauth.OpenAPISHA256` |

To check a download, run `sha256sum -c openapi.json.sha256` in the folder that holds both files. Compare the digest with the value your SDK reports to see which API version the SDK was built against.