Access Levels
Public writes stay blocked. A submission permission does not grant approval or publication.
Machine Authentication
Send a partner API key inX-API-Key. This is API-key-based M2M authentication, not an OAuth client-credentials flow.
TattooAPI checks that the key is valid, has an active TattooAPI actor mapping, and is allowed to perform the requested operation within the relevant organization, artist, or studio scope.
Missing or invalid credentials return 401. Valid credentials without an active mapping or sufficient access return 403.
Use Authentication for headers and permissions.
Owner And Cross-Studio Privacy
Owner endpoints use explicit/api/v1/me/* paths. They may return private or draft records belonging to the authorized owner. Do not expose those responses through a public website.
Other studios’ private records, unpublished media, review notes, customer details, and financial information are outside the public discovery contract.
Portfolio Permissions
portfolio_intake:stage allows approved staging operations. portfolio_intake:review is reserved for separately authorized reviewers.
Some approved service integrations may receive portfolio_intake:stage_cross_tenant. This is not a self-service key permission and never grants approval or publication authority.
See Portfolio Intake Workflow.