On this page
Authentication and scopes
Clearline LIMS read-only API access is optional, tenant-scoped, and disabled unless Clearline provisions it for your organization. Credentials are issued only after Clearline confirms the integration owner, technical contact, intended use, and minimum data scope needed.
Credential provisioning#
Clearline Support confirms the following before API access is enabled:
- tenant or organization scope;
- named integration owner and technical contact;
- requested data areas, such as samples or published reports;
- expected query volume and schedule;
- where downloaded data will be stored;
- rotation, revocation, and support escalation contacts.
Credentials are not self-service. If your organization needs access, contact Clearline Support and request a read-only API review.
Authorization header#
Use the provisioned token only in the authorization header for approved read-only requests.
GET /api/v1/samples HTTP/1.1
Host: api.example.clearlinelims.test
Authorization: Bearer <example-read-only-token>
Accept: application/json
The host, token, tenant identifier, and available endpoints are confirmed during onboarding. Do not copy tokens into tickets, email, screenshots, source control, shared spreadsheets, or chat transcripts.
Scope model#
API access is intended to be least-privilege. A token may be limited by:
| Scope type | Example boundary |
|---|---|
| Tenant | Records available within the provisioned Clearline LIMS tenant scope. |
| Client or project | Records available within an approved client, project, location, or submitter scope. |
| Data area | A provisioned read-only data area, such as samples or reports. |
| Status | A provisioned status boundary, such as published reports or active samples. |
| Time range | A time-bounded record window, where appropriate for the integration. |
Exact scopes are tenant-specific and are confirmed by Clearline Support.
Rotation and revocation#
Request token rotation when:
- a credential may have been exposed;
- an integration owner changes;
- a vendor relationship ends;
- the integration is moved to a new system;
- scheduled credential review is due.
If a credential may be compromised, stop using it and contact Clearline Support for revocation and replacement.
Read-only boundary#
Read-only API credentials must not be used for sample creation, result entry, workflow changes, user administration, setup changes, or other write operations. Those workflows require a separate implementation review.