4. API token

Each request must contain the token in one of the following headers:

• Authorization: Bearer <token> is the primary method of passing the token;
• x-api-key: <token> is an alternative method used, among others, by the Anthropic SDK.

Passing the token in the query string is not supported: such a request is treated as a request without a token.

curl https://api.bbx.kz/os/v1/me \
  -H "Authorization: Bearer qos_YOUR_TOKEN"

# The same token in the x-api-key header
curl https://api.bbx.kz/os/v1/me \
  -H "x-api-key: qos_YOUR_TOKEN"

If the token is missing, invalid or revoked, a 401 response with the code invalid_api_key is returned; if it has expired, a 401 response with the code token_expired; if it has been blocked, a 403 response with the code token_blocked.

4.1. Token information

The GET /os/v1/me request returns information about the token and its usage statistics for the current month. The request does not require access to any module and is used to check that an integration is operational.

{
  "token": {
    "name": "Student services integration",
    "prefix": "qos_Xk2Lp9aQ",
    "modules": ["ALEM", "ACADEMIC", "SCHEDULING"],
    "rpmLimit": 120,
    "expiresAt": "2027-06-30T23:59:59Z"
  },
  "usage": {
    "month": "2026-10",
    "requests": 1842,
    "totalTokens": 512300
  }
}

Response fields:

• token.name is the token name;
• token.prefix contains the initial characters of the token used to identify it;
• token.modules contains the codes of available modules;
• token.rpmLimit is the permitted number of requests per minute, or null if no limit is set;
• token.expiresAt is the date and time when the token expires, or null if its validity is not limited;
• usage contains the number of requests and the number of tokens consumed by models in the current month.