Credentials Security Audit Flow

This recipe was an interactive walkthrough in the previous portal. Each step below names the API call it makes; open it in the API Reference to try it.

OverviewCopy Anchor Link

Credentials Security Audit FlowCopy Anchor Link

This recipe walks you through auditing the security posture of your API credentials at the company level.

Flow OverviewCopy Anchor Link

1. List API Credentials — Retrieve all API credentials under your company account.
2. Check Allowed Origins — Inspect the domain restrictions for the first credential. An empty list means any domain can use it — a security risk.
3. Review Credential Details — Examine the credential's full profile: its roles, active status, and client key.

API Endpoints InvolvedCopy Anchor Link

• GET /companies/{companyId}/apiCredentials
• GET /companies/{companyId}/apiCredentials/{apiCredentialId}/allowedOrigins
• GET /companies/{companyId}/apiCredentials/{apiCredentialId}

⚠️ PrerequisitesCopy Anchor Link

• Your Company ID (companyId) — found in your Adyen Customer Area under Settings > Account.
• An API key with the Management API — API credentials read and write role.

Tip: The credentialId from Step 1 is automatically passed to Steps 2 and 3.

Step 1: List API CredentialsCopy Anchor Link

Returns the full list of API credentials

API call: listCompanyApiCredentials

Example arguments:

{
                        companyId: "APIMatic300"
                    }

Step 2: Check Allowed OriginsCopy Anchor Link

Returns the list of allowed origins

API call: listCompanyApiCredentialOrigins

Example arguments:

{
                        ...(companyId && { companyId }),
                        apiCredentialId: credentialId,
                    }

Step 3: Review Credential DetailsCopy Anchor Link

Returns the complete details of credential

API call: getCompanyApiCredential

Example arguments:

{
                        ...(companyId && { companyId }),
                        apiCredentialId: credentialId,
                    }