REST API

This document describes how to use the IDmelon Admin Panel REST API to access workspace data programmatically. The same data you see in the Admin Panel—statistics, users, user details, security keys, and authentication activity—can be retrieved via API for reporting, integrations, or automation.

Base URL #

All API requests are sent to your workspace SKM (Security Key Manager) base URL:

• US (default): https://skm.idmelon.com
• EU: https://skm.eu.idmelon.com
• Dedicated deployment: your own SKM host, normally https://skm.idmelon.{companydomain} (e.g. https://skm.idmelon.acme.com)

Use the base URL that corresponds to your Admin Panel / workspace and region.

Authentication #

The API uses API key authentication. Include your API key in every request.

Using the API key #

Send the API key in the Authorization header:

Example (Postman):

1. In the request Authorization tab, choose type API Key.
2. Set Key to Authorization.
3. Set Value to your API key.

Example (cURL):

curl -H "Authorization: YOUR_API_KEY" "https://skm.eu.idmelon.com/administrator/statistics/users"

Example (HTTP header):

GET /administrator/statistics/users HTTP/1.1
Host: skm.eu.idmelon.com
Authorization: YOUR_API_KEY

Note: Create and manage API keys in the Admin Panel under Workspace > API Keys. Keep your API key secret and do not share it or commit it to source control.

Statistics #

Endpoints that mirror the Stats area in the Admin Panel (workspace users, security keys, groups, and login activity).

Query parameters (e.g. login):

• timezone (optional) – IANA timezone (e.g. America/Vancouver) for time-based stats.

Example:

GET https://skm.eu.idmelon.com/administrator/statistics/login?timezone=America/Vancouver
Authorization: YOUR_API_KEY

Users #

List and work with users in the workspace.

Query parameters (list):

• limit (optional) – Max number of items to return per page (e.g. 50).
• skip (optional) – Number of items to skip (offset) for pagination (e.g. 50).

Example (list):

GET https://skm.eu.idmelon.com/administrator/tokens/v2?limit=50
Authorization: YOUR_API_KEY

The list response also includes skip, limit, total, and a details summary (e.g. activeTokens, pendingTokens, blockTokens, notInvitedTokens, noDeviceTokens) that mirrors the counters shown on the All Users page.

Bulk delete users:

POST /administrator/tokens/deleteMany removes one or more users. Send a JSON body with a tokens array of user IDs (the _id values from the users list):

POST https://skm.eu.idmelon.com/administrator/tokens/deleteMany
Authorization: YOUR_API_KEY
Content-Type: application/json

{ "tokens": ["6a0217b02571b6081b96e1e2"] }

A successful call returns:

{ "message": "User has been successfully deleted." }

Warning: This is a destructive, irreversible operation that deletes the user and their associated keys. Double-check the IDs before calling it.

User details #

Endpoints used for the User Details page: user info, activities, security keys, passkeys (credentials), and assigned groups.

Replace {userId} with the user’s ID (returned from the users list endpoint).

Query parameters:

• limit (optional) – Max items (e.g. 50) where supported.
• userId (optional) – For /administrator/groups, restricts results to groups for that user.

Examples:

GET https://skm.eu.idmelon.com/administrator/tokens/USER_ID
Authorization: YOUR_API_KEY

GET https://skm.eu.idmelon.com/administrator/tokens/userInfo/USER_ID/securitykeys/v2?limit=50
Authorization: YOUR_API_KEY

GET https://skm.eu.idmelon.com/administrator/groups?userId=USER_ID
Authorization: YOUR_API_KEY

Security keys #

The Security Keys page lists every security key (credential) issued in the workspace. Each key belongs to a user (token.owner) and tracks its usage (lastActivity and totalActivities). This is the endpoint to use for key inventory, lifecycle, and activity reporting.

Query parameters:

Selected response fields (per key):

The response envelope also includes skip, limit, a statistics breakdown (counts by key type), and a filters echo of the filters that were applied.

Useful queries #

Find the least-active (stale) security keys #

Sort ascending by lastActivity to surface the keys that have gone the longest without being used — ideal for spotting dormant keys that may be candidates for revocation or cleanup:

GET https://skm.eu.idmelon.com/administrator/securityDevice?status=20&limit=50&sort=lastActivity,ascend
Authorization: YOUR_API_KEY

curl -H "Authorization: YOUR_API_KEY" \
  "https://skm.eu.idmelon.com/administrator/securityDevice?status=20&limit=50&sort=lastActivity,ascend"

Find the most-recently-used keys #

Reverse the direction to list the most active keys first:

GET https://skm.eu.idmelon.com/administrator/securityDevice?status=20&limit=50&sort=lastActivity,descend
Authorization: YOUR_API_KEY

List only active keys (no sorting) #

GET https://skm.eu.idmelon.com/administrator/securityDevice?status=20&limit=50
Authorization: YOUR_API_KEY

List pending / non-active keys #

GET https://skm.eu.idmelon.com/administrator/securityDevice?status=30&limit=50
Authorization: YOUR_API_KEY

Tip: Combine sort=lastActivity,ascend with a high limit to build a “stale key” report, then page through with skip for large workspaces.

Delete security keys #

Remove one or more security keys from the workspace. Deleting a key revokes it and frees any license associated with it.

Delete a single key #

Use the key’s _id (the _id field from the /administrator/securityDevice list). The same value is sent both in the path and as the _id query parameter:

DELETE https://skm.eu.idmelon.com/administrator/securityDevice/KEY_ID?_id=KEY_ID
Authorization: YOUR_API_KEY

curl -X DELETE -H "Authorization: YOUR_API_KEY" \
  "https://skm.eu.idmelon.com/administrator/securityDevice/KEY_ID?_id=KEY_ID"

Success response:

{ "message": "The user's security key has been successfully deleted." }

Delete multiple keys (bulk) #

Send a JSON body with an _ids array of key _id values to the collection path (note the trailing slash):

DELETE https://skm.eu.idmelon.com/administrator/securityDevice/
Authorization: YOUR_API_KEY
Content-Type: application/json

{ "_ids": ["65dcff77a5f39100085fe897"] }

Success response:

{ "message": "The selected security keys have been successfully deleted." }

Warning: Deleting a security key is irreversible — the user must enroll a new key to authenticate again. Deletion removes only the key; to deprovision the user, manage the user lifecycle through your source directory (e.g. Microsoft Entra ID via SCIM) or the user-level /administrator/tokens/deleteMany endpoint.

Automate inactive-key cleanup #

Combine the listing, sorting, and deletion endpoints to remove keys that have been unused for a defined period:

1. List & sort by activity — GET /administrator/securityDevice?status=20&limit=50&sort=lastActivity,ascend returns active keys with the least recently used first.
2. Select stale keys — keep entries whose lastActivity.createdAt is older than your inactivity threshold (X days). Keys that have never been used have no lastActivity and totalActivities: 0.
3. Delete — call DELETE /administrator/securityDevice/ with the selected _id values in _ids to revoke them and reclaim their licenses.

Run this as a scheduled job to continuously enforce an inactivity policy.

Devices (end-user apps) #

Distinct from security keys, the Devices endpoint lists the end-user devices (phones and desktops running the IDmelon app) registered in the workspace.

Each entry includes displayName, createdDateTime, hasOfflineAccess, and, where available, an apps object with the installed app version. The response envelope includes skip, limit, total, totalOfDevices, totalOfAccessKey, and totalWithoutApp.

Query parameters:

• limit (optional) – Max number of devices per page (e.g. 50).
• skip (optional) – Offset for pagination.

Example:

GET https://skm.eu.idmelon.com/administrator/devices?limit=50
Authorization: YOUR_API_KEY

Authentication logs #

This endpoint backs the Reports → Authentication Logs page. It returns every authentication-related event in the workspace — each time a user authenticates to a relying party (application/site) with a security key. Workspaces commonly accumulate tens of thousands of entries, so the endpoint supports filtering by action, relying party, and date range, plus pagination.

Query parameters:

Response:

The response is an envelope with the matching entries plus pagination metadata:

{
  "data": [
    {
      "createdAt": "2026-06-08T23:21:26.614Z",
      "action": 2,
      "status": 1,
      "rpInfo": { "name": "IDmelon", "id": "idmelon.com" },
      "userInfo": { "name": "[email protected]", "displayName": "[email protected]" },
      "ownerId": "[email protected]",
      "deviceName": "User's iPhone",
      "securityKeyDevice": "642dd340d45192000bc6bdb8"
    }
  ],
  "total": 23833,
  "skip": 0,
  "limit": 50
}

Selected fields (per log entry):

Cross-reference: A log entry’s securityKeyDevice and _id line up with the lastActivity recorded on /administrator/securityDevice, so you can pivot from a key to its authentication history and back.

Useful queries #

Recent authentications only #

GET https://skm.eu.idmelon.com/administrator/workspace/activity/logs?limit=50&action=2
Authorization: YOUR_API_KEY

Logins to a specific application (relying party) #

GET https://skm.eu.idmelon.com/administrator/workspace/activity/logs?limit=50&rp=idmelon.com
Authorization: YOUR_API_KEY

Activity for a relying party within a date range #

Combine rp with from/to to build a per-application audit report for a reporting period:

GET https://skm.eu.idmelon.com/administrator/workspace/activity/logs?limit=50&rp=idmelon.com&from=2026-06-01T07:00:00.000Z&to=2026-06-08T07:00:00.000Z
Authorization: YOUR_API_KEY

curl -H "Authorization: YOUR_API_KEY" \
  "https://skm.eu.idmelon.com/administrator/workspace/activity/logs?limit=50&from=2026-06-01T07:00:00.000Z&to=2026-06-08T07:00:00.000Z"

Page through the full log #

Use total from the first response to page with skip (0, 50, 100, …):

GET https://skm.eu.idmelon.com/administrator/workspace/activity/logs?limit=50&skip=50
Authorization: YOUR_API_KEY

Tip: Logs are returned newest-first. Pair from/to with limit and skip to export a bounded time window without walking the entire history.

Other workspace endpoints #

These endpoints support other Admin Panel areas (workspace settings, admins, API keys, groups, etc.):

Use the same Authorization header with your API key for all of these.

Response format #

• Successful responses return JSON.
• Standard HTTP status codes apply (e.g. 200 OK, 304 Not Modified for cached/conditional requests, 401 Unauthorized for invalid or missing API key, 404 Not Found).
• Pagination: list endpoints accept limit (page size) and skip (offset), and echo them back in the response alongside a total count. To page through results, increase skip by limit on each request (e.g. skip=0, skip=50, skip=100, …) until you have read total items.
• Sorting: where supported (e.g. /administrator/securityDevice), use sort=field,direction with direction ascend or descend.

Quick reference (Postman) #

1. Base URL: Your SKM base URL (e.g. https://skm.eu.idmelon.com).
2. Auth: Type API Key → Key: Authorization, Value: {your-api-key}.
3. Paths: Use the endpoints above (e.g. /administrator/statistics/users, /administrator/securityDevice?status=20&limit=50&sort=lastActivity,ascend).

If you need more detail on a specific endpoint (request/response bodies or additional query parameters), refer to your Admin Panel behavior or contact IDmelon support.