API keys & API

API keys let scripts and CI pipelines read your projects, test cases and results, and download reports, through the Qalion REST API.

Create a key

Open Integrations → API keys (Owners and Admins).

Click New API key and enter a Key name, for example "CI pipeline".

Choose an Expiration: Never expires, 30 days, 90 days or 1 year.

Under Permissions, Read projects, Read runs and Write runs come ticked. Untick what the key does not need, and tick Write projects only if it must create or change data.

Click Generate key and copy the key right away. This is the only time you can see it.

Keys look like wky_ followed by 64 characters. The list shows only their first characters.

Integrations, API keys tab: two active keys, GitHub Actions and Nightly report export, each with its expiry date, the first characters of the key, its permissions and a Revoke button — Integrations → API keys: each key shows its first characters, permissions and expiry date.

Warning

Always give a key explicit permissions. A key with no permissions is refused by the API.

Note

A key acts as the person who created it. If that person leaves the organization, the key stops working; if their role changes, the key's access changes with it. Keep keys out of code and public repositories.

Scopes

Scope	Allows
`projects:read`	Reading projects, test cases, folders, results, run lists, insights, problems and requirements, and downloading exports. Shown as Read projects.
`projects:write`	Creating and changing that data. Shown as Write projects.
`runs:read`	Reading test executions
`runs:write`	Changing test executions

These four are the only scopes the API enforces, and the only ones the Permissions list offers. Integrations → API keys pre-ticks projects:read, runs:read and runs:write, which is what an MCP integration needs; untick any of them before you generate the key.

Call the API

Base URL: https://<your-qalion-host>/api/v1, where the host is the address of your Qalion app.
Send the key in an x-api-key header. Authorization: Bearer works too.
Find the IDs in the app's addresses: /dashboard/<org>/… for the organization, …/execution/tests/<projectId> for a project and …/execution/runs/<runId> for a run. The organization can be its ID or its slug.

Examples

All of these need projects:read.

Set upbash

export QALION="https://<your-qalion-host>/api/v1"
export QALION_KEY="wky_..."

List projectsbash

curl -H "x-api-key: $QALION_KEY" \
  "$QALION/projects?orgSlug=<org>"

List the test cases of a projectbash

curl -H "x-api-key: $QALION_KEY" \
  "$QALION/organizations/<org>/tests/projects/<projectId>/test-cases"

Recent runs, with failures and durationsbash

curl -H "x-api-key: $QALION_KEY" \
  "$QALION/<org>/projects/<projectId>/quality/runs"

Download a run as JUnit XMLbash

curl -H "x-api-key: $QALION_KEY" -o junit.xml \
  "$QALION/<org>/projects/<projectId>/exports/runs/<runId>/junit"

The same exports path also offers:

Path (after /exports/)	Returns
`runs/<runId>/report`	The PDF report of a run
`runs/<runId>/evidence`	The evidence bundle (.zip) of a run
`runs/csv`	Runs as CSV

Use in CI

Today, an API key can't start a test plan. Run plans from Qalion, by hand or on a schedule, and let your CI pipeline read the results: list recent runs, then download the JUnit XML of a run for your CI's test report.

Revoke, delete, expire

Revoke stops a key immediately. It stays in the list as Revoked.
Delete removes it from the list for good.
A key past its expiration date shows as Expired and is refused.
The list shows when each key was last used.

Was this page helpful?

Private apps