Keys & permissions
Give each connection a clear purpose and just enough access.
Create a key
- Open the Wingman Developers site, sign in with your Wingman account, then open Connections & API and select Create key.
- Name the connection, choose its permissions and select an expiry of 30 days, 90 days or one year.
- Copy the key once and store it in your tool’s secret store. Wingman stores a fingerprint and cannot reveal it again.
Choose what it can do
Permissions are independent. A practice-paper assistant usually needs questions:read, papers:write and papers:read. An automated marking assistant usually needs marking:submit and marking:read. Starting from a saved Builder paper also requires papers:read.
Reading marked work covers the owner’s marking area, including drafts and in-progress work. API keys cannot manage other keys, change account details, or access administration.
| Permission | Access |
|---|---|
| questions:read | Search published questions; read their content, schemes and diagrams. |
| papers:read | Read your saved Builder papers and prepared PDFs. |
| papers:write | Create and update papers; prepare PDFs. |
| marking:read | Read your uploaded scans, marking sessions and results. |
| marking:submit | Upload work and request Wingman automated marking. |
| marking:import | Upload and submit externally marked work. |
| marking:review | Edit existing mark decisions and annotations. |
Authenticate a request
Use the Authorization header on every request, including private file downloads. The public API does not accept a browser session as authentication.
curl "https://api.wingmanmaths.com/v1/me" \
-H "Authorization: Bearer $WINGMAN_API_KEY"Replace or revoke
Create a replacement to change a key’s permissions. Move the connection to the replacement, then revoke the old key. You can have up to 20 active keys.
Revocation stops new requests immediately; already accepted work may finish. Keys also stop working on expiry or when the account is no longer verified. Account restrictions still apply to API requests.
Track usage
The key list shows lifetime requests, errors and the last use time. Open Usage for a 30-day breakdown by UTC date, operation and response status.
Usage records contain counts and timings, not keys, request bodies, scan content or search terms. These are API request counts, not model-token usage or a billing statement.