Additional API endpoints
By Chris Winfield-Blum
•
August 18, 2026
In addition to GET /user, GET /check-in, GET /vaults, and lock/unlock, the API also exposes:
GET /validate-api-key
Confirms that the Bearer token is valid and not expired. Optional device_name and device_type values rename the token to a mobile-app connection label (for example Mobile App Connection - Pixel (Android)) and update last_used_at.
{"status":"success","message":"API key is valid"}
Missing or invalid tokens return 401 with unauthorized or expired.
POST /support/ask
Sends a question to the support AI assistant (same behaviour as the website). JSON body:
{"question": "How do Spark vaults work?"}
Questions are limited to 500 characters. The response includes an answer, sources, a query id, and whether a cached answer was used.