Authentication

All write operations require an API token passed in the X-QSC-Token request header.

X-QSC-Token: <your-token>

Token Types

QSC uses three tokens. They share the same header name — pick the one that matches the endpoint group:

Token	Used for	Source	Required permission
Admin token	Schema updates (/api/v1/searchapp/*)	QSC Admin → Security → API Tokens	WRITE on the tenant
Feeding token	Data operations and scheduling (/api/v1/data/*, /api/v1/job/*)	QSC Admin → Security → API Tokens	WRITE on the tenant
Agent token	Agent Chat (/api/v1/agent/chat/*)	Agent-server AUTH_TOKEN	—

Search endpoints (/api/v1/search/*) require no authentication.

The agent token is separate from the per-tenant admin and feeding tokens. Details for chat calls are on the Chat API page.

Where to Find Your Tokens

Admin and feeding tokens are managed in the QSC Admin UI under Security → API Tokens.

The agent token is the agent-server AUTH_TOKEN.

Examples

Admin token (schema)

curl -X PUT https://qsc.quasiris.de/api/v1/searchapp/schema/demo/trendware \
  -H "Content-Type: application/json" \
  -H "X-QSC-Token: <your-admin-token>" \
  -d '{...}'

Feeding token (data)

PUT /api/v1/data/bulk/qsc/demo/trendware
X-QSC-Token: <your-feeding-token>
Content-Type: application/json

Agent token (chat)

POST /api/v1/agent/chat/demo/support-bot
X-QSC-Token: <your-agent-token>
Content-Type: application/json

Status Codes

Code	Description
401	Missing or invalid token
403	Token does not have the required permission on the tenant