Create a Teams API key
Use a service key when a script, MCP client or workflow must work in a Teams space. You can start in General research; a client folder is optional. A personal API key cannot access the Teams service API.
1. Choose one job for the key
In Teams → API integrations → New integration, the permission checkboxes have technical names. Start with one of these combinations:
| What the integration should do | Select these permissions | Credit limit per cycle |
|---|---|---|
| Search with a script, MCP or n8n | search:read | Set the maximum you want this integration to spend |
| Use Subfinder or enumerate subdomains | tools:execute | Set a positive maximum; assign exactly one research space for Subfinder |
| Search and run asset tools | search:read, tools:execute | Set a maximum for both operations together |
| Read existing cases and reports | cases:read, reports:read | 0 if it will only read |
| Read and manage continuous monitors | watches:read, watches:write | 0 if it only manages monitors and reads their journal |
Add a permission only for a task you actually need. exports:create allows
private exports. cases:write, evidence:write and reports:render allow
editing case material and preparing report drafts. Add cases:share only
when the integration must make its writes visible to client accounts; it does
nothing by itself. The full permission reference
lists the operations behind each permission.
2. Create the integration and its key
- Give the integration a name that identifies the workflow.
- Under Authorized clients, select General research or the client folder this workflow should access. Select more than one only if it needs them all. Read permissions can include internal data in every selected space.
- Tick the permissions from the table above and set the Integration credit limit per cycle. This is a ceiling shared by all keys of this integration, not a new credit allocation.
- Select Save integration, then Service keys → Create service key. Choose its validity and copy the secret into your credential manager. It is shown once.
The integration is the named access policy; a key is its credential. Editing an integration does not give new permissions to keys already issued. Create or rotate a key after changing access. Revoking the integration revokes all its keys.
3. Check access without spending credits
Store the copied secret in PROFUNDIS_SERVICE_KEY in your local environment or
credential manager. Then call:
curl -sS https://api.profundis.io/api/v2/service/whoami \
-H "Authorization: Bearer $PROFUNDIS_SERVICE_KEY"
The response contains organization_id, your allowed clients with their
id, the current scopes and the integration's credit ceiling. Use one returned
client ID in later requests, including for General research. whoami is free.
Never put the key in a URL, repository or workflow export.
Before a paid search batch, request a free quote
with ?dry_run=true. The quote creates no job and reserves no credits. A real
search needs an Idempotency-Key; poll the returned job instead of submitting
the same search again.
Continue with your use case
Subfinder accepts an organization pb2b_ key in its profundis provider
configuration. A personal pk_ key is not required. Follow the
Subfinder setup for permissions and
the single research-space requirement.
| Need | Guide |
|---|---|
| Search or use the HTTP API | Requests, jobs, errors and OpenAPI |
| Connect Claude Code, Codex or n8n | MCP and workflow automation |
| Read a previous client engagement | Read-only engagement setup |
| Export, monitor or write case material | Detailed service API reference |
If whoami returns 401, check that the key is active and is a Teams service
key. If an operation returns 403, check the selected client and its permission
in the whoami response. A credit limit is separate from permission: raising
it cannot grant a missing scope.