Account and security

Updated on 5 November 20261 min read

The API can now read the account details. Changes are still made in My MozOut, and API keys are managed on the API page.

What you need

A key with the account:read permission. See Permissions.

The account details

GET /v1/account returns the name, company, email, address, currency and status of the account. It never returns passwords or card data.

curl

curl "https://api.mozout.com/v1/account" \
  -H "Authorization: Bearer $RLX_API_KEY" \
  -H "Accept-Language: en"

PHP

<?php
$ch = curl_init('https://api.mozout.com/v1/account');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('RLX_API_KEY'),
        'Accept-Language: en',
    ],
]);
$body = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo $status, PHP_EOL, $body, PHP_EOL;

Python

import os
import requests

headers = {
    "Authorization": "Bearer " + os.environ["RLX_API_KEY"],
    "Accept-Language": "en",
}
r = requests.get("https://api.mozout.com/v1/account", headers=headers, timeout=30)
print(r.status_code)
print(r.text)

JavaScript

const response = await fetch("https://api.mozout.com/v1/account", {
  headers: {
    Authorization: `Bearer ${process.env.RLX_API_KEY}`,
    "Accept-Language": "en",
  },
});
console.log(response.status);
console.log(await response.text());

Contacts and users

GET /v1/account/contacts: the contacts registered on the account.
GET /v1/account/users: the people with access to the account. The owner comes first, with owner set to true.

These lists come in pages.

What is planned

Change the account details and contacts.
See the security log and manage SSH keys.

A key can never create another key, or change the password or email of the account.

Operations

3 operations in this area. Click an operation to see its parameters, examples and responses, or to try it in the Playground, without leaving the page.

GET

See the account

/v1/account

GEThttps://api.mozout.com/v1/account

Needs account:read. Never returns passwords or card data.

Authentication

Needs a valid key in the Authorization: Bearer header. Required permission: account:read.

Parameters

Name	In	Type	Required	Description
`X-API-Mode`	header	string: sandbox, production	no	Optional. If it does not match the mode of the key, the request is refused with `invalid_request` and reason `mode_mismatch`. Use it to make sure a program never runs with the wrong key.

Examples

curl

curl "https://api.mozout.com/v1/account" \
  -H "Authorization: Bearer $RLX_API_KEY" \
  -H "Accept-Language: en"

PHP

<?php
$ch = curl_init('https://api.mozout.com/v1/account');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('RLX_API_KEY'),
        'Accept-Language: en',
    ],
]);
$body = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo $status, PHP_EOL, $body, PHP_EOL;

Python

import os
import requests

headers = {
    "Authorization": "Bearer " + os.environ["RLX_API_KEY"],
    "Accept-Language": "en",
}
r = requests.get("https://api.mozout.com/v1/account", headers=headers, timeout=30)
print(r.status_code)
print(r.text)

JavaScript

const response = await fetch("https://api.mozout.com/v1/account", {
  headers: {
    Authorization: `Bearer ${process.env.RLX_API_KEY}`,
    "Accept-Language": "en",
  },
});
console.log(response.status);
console.log(await response.text());

Responses

200

See the account.

{
  "data": {
    "id": 35,
    "first_name": "Ana",
    "last_name": "Silva",
    "company": "Exemplo, Lda",
    "email": "[email protected]",
    "phone": "+258.841234567",
    "tax_id": "",
    "address": {
      "line1": "Av. 25 de Setembro, 100",
      "line2": "",
      "city": "Maputo",
      "state": "Maputo",
      "postcode": "1100",
      "country": "MZ"
    },
    "currency": "USD",
    "language": "portuguese",
    "status": "active",
    "email_verified": true,
    "created_at": "2026-01-15"
  },
  "meta": {}
}

Header	Description
`X-Correlation-ID`	Identifier of this request. Give it to support when you report a problem.
`X-RateLimit-Limit`	Requests allowed per minute.
`X-RateLimit-Remaining`	Requests left in the current minute.
`X-RateLimit-Reset`	When the minute ends, as a Unix timestamp in seconds.
`X-API-Mode`	The mode of the key that made the request: `sandbox` or `production`.

401

The key is missing, invalid, revoked or expired, or the user who created it no longer has access to the account.

{
  "error": {
    "code": "unauthorized",
    "message": "Missing or invalid API key.",
    "correlation_id": "0f8fad5b-d9cb-469f-a165-70867728950e",
    "details": {}
  }
}

403

The account cannot use the API (forbidden), the key lacks the permission (insufficient_scope), or the IP address is not on the list of the key (ip_not_allowed).

{
  "error": {
    "code": "insufficient_scope",
    "message": "This key does not have the required permission.",
    "correlation_id": "0f8fad5b-d9cb-469f-a165-70867728950e",
    "details": {
      "required": "dns:read"
    }
  }
}

429

Too many requests. Wait for the time in Retry-After.

{
  "error": {
    "code": "rate_limited",
    "message": "Too many requests. Please try again shortly.",
    "correlation_id": "0f8fad5b-d9cb-469f-a165-70867728950e",
    "details": {
      "retry_after": 42
    }
  }
}

Header	Description
`Retry-After`	Seconds to wait before trying again.

500

An internal error occurred. Give the correlation_id to support.

{
  "error": {
    "code": "internal_error",
    "message": "An internal error occurred. Please give the correlation_id to support.",
    "correlation_id": "0f8fad5b-d9cb-469f-a165-70867728950e",
    "details": {}
  }
}

503

The API is turned off.

{
  "error": {
    "code": "disabled",
    "message": "The API is currently turned off.",
    "correlation_id": "0f8fad5b-d9cb-469f-a165-70867728950e",
    "details": {}
  }
}

Errors

Status	Code	Meaning
401	`unauthorized`	The key is missing, invalid, revoked or expired, or the user who created it no longer has access to the account.
403	`forbidden`, `insufficient_scope`, `ip_not_allowed`	The account cannot use the API (`forbidden`), the key lacks the permission (`insufficient_scope`), or the IP address is not on the list of the key (`ip_not_allowed`).
429	`rate_limited`	Too many requests. Wait for the time in Retry-After.
500	`internal_error`	An internal error occurred. Give the correlation_id to support.
503	`disabled`	The API is turned off.

The error format is explained in Errors.

GET

List the contacts

/v1/account/contacts

GEThttps://api.mozout.com/v1/account/contacts

Needs account:read. The contacts registered on the account.

Authentication

Needs a valid key in the Authorization: Bearer header. Required permission: account:read.

Parameters

Name	In	Type	Required	Description
`page`	query	integer	no	The page number. The first is 1.
`per_page`	query	integer	no	Results per page, from 1 to 100. The default is 10.
`X-API-Mode`	header	string: sandbox, production	no	Optional. If it does not match the mode of the key, the request is refused with `invalid_request` and reason `mode_mismatch`. Use it to make sure a program never runs with the wrong key.

Examples

curl

curl "https://api.mozout.com/v1/account/contacts" \
  -H "Authorization: Bearer $RLX_API_KEY" \
  -H "Accept-Language: en"

PHP

<?php
$ch = curl_init('https://api.mozout.com/v1/account/contacts');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('RLX_API_KEY'),
        'Accept-Language: en',
    ],
]);
$body = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo $status, PHP_EOL, $body, PHP_EOL;

Python

import os
import requests

headers = {
    "Authorization": "Bearer " + os.environ["RLX_API_KEY"],
    "Accept-Language": "en",
}
r = requests.get("https://api.mozout.com/v1/account/contacts", headers=headers, timeout=30)
print(r.status_code)
print(r.text)

JavaScript

const response = await fetch("https://api.mozout.com/v1/account/contacts", {
  headers: {
    Authorization: `Bearer ${process.env.RLX_API_KEY}`,
    "Accept-Language": "en",
  },
});
console.log(response.status);
console.log(await response.text());

Responses

200

List the contacts.

{
  "data": [
    {
      "id": 7,
      "first_name": "Rui",
      "last_name": "Costa",
      "company": "",
      "email": "[email protected]",
      "phone": "+258.821234567",
      "address": {
        "line1": "Av. 25 de Setembro, 100",
        "line2": "",
        "city": "Maputo",
        "state": "Maputo",
        "postcode": "1100",
        "country": "MZ"
      }
    }
  ],
  "meta": {
    "page": 1,
    "per_page": 10,
    "total": 1,
    "total_pages": 1
  }
}

Header	Description
`X-Correlation-ID`	Identifier of this request. Give it to support when you report a problem.
`X-RateLimit-Limit`	Requests allowed per minute.
`X-RateLimit-Remaining`	Requests left in the current minute.
`X-RateLimit-Reset`	When the minute ends, as a Unix timestamp in seconds.
`X-API-Mode`	The mode of the key that made the request: `sandbox` or `production`.

401

The key is missing, invalid, revoked or expired, or the user who created it no longer has access to the account.

{
  "error": {
    "code": "unauthorized",
    "message": "Missing or invalid API key.",
    "correlation_id": "0f8fad5b-d9cb-469f-a165-70867728950e",
    "details": {}
  }
}

403

The account cannot use the API (forbidden), the key lacks the permission (insufficient_scope), or the IP address is not on the list of the key (ip_not_allowed).

{
  "error": {
    "code": "insufficient_scope",
    "message": "This key does not have the required permission.",
    "correlation_id": "0f8fad5b-d9cb-469f-a165-70867728950e",
    "details": {
      "required": "dns:read"
    }
  }
}

422

Some of the data is not valid.

{
  "error": {
    "code": "validation_failed",
    "message": "Some of the data is not valid.",
    "correlation_id": "0f8fad5b-d9cb-469f-a165-70867728950e",
    "details": {}
  }
}

429

Too many requests. Wait for the time in Retry-After.

{
  "error": {
    "code": "rate_limited",
    "message": "Too many requests. Please try again shortly.",
    "correlation_id": "0f8fad5b-d9cb-469f-a165-70867728950e",
    "details": {
      "retry_after": 42
    }
  }
}

Header	Description
`Retry-After`	Seconds to wait before trying again.

500

An internal error occurred. Give the correlation_id to support.

{
  "error": {
    "code": "internal_error",
    "message": "An internal error occurred. Please give the correlation_id to support.",
    "correlation_id": "0f8fad5b-d9cb-469f-a165-70867728950e",
    "details": {}
  }
}

503

The API is turned off.

{
  "error": {
    "code": "disabled",
    "message": "The API is currently turned off.",
    "correlation_id": "0f8fad5b-d9cb-469f-a165-70867728950e",
    "details": {}
  }
}

Errors

Status	Code	Meaning
401	`unauthorized`	The key is missing, invalid, revoked or expired, or the user who created it no longer has access to the account.
403	`forbidden`, `insufficient_scope`, `ip_not_allowed`	The account cannot use the API (`forbidden`), the key lacks the permission (`insufficient_scope`), or the IP address is not on the list of the key (`ip_not_allowed`).
422	`validation_failed`	Some of the data is not valid.
429	`rate_limited`	Too many requests. Wait for the time in Retry-After.
500	`internal_error`	An internal error occurred. Give the correlation_id to support.
503	`disabled`	The API is turned off.

The error format is explained in Errors.

GET

List the users

/v1/account/users

GEThttps://api.mozout.com/v1/account/users

Needs account:read. The people with access to the account. The owner comes first.

Authentication

Needs a valid key in the Authorization: Bearer header. Required permission: account:read.

Parameters

Name	In	Type	Required	Description
`page`	query	integer	no	The page number. The first is 1.
`per_page`	query	integer	no	Results per page, from 1 to 100. The default is 10.
`X-API-Mode`	header	string: sandbox, production	no	Optional. If it does not match the mode of the key, the request is refused with `invalid_request` and reason `mode_mismatch`. Use it to make sure a program never runs with the wrong key.

Examples

curl

curl "https://api.mozout.com/v1/account/users" \
  -H "Authorization: Bearer $RLX_API_KEY" \
  -H "Accept-Language: en"

PHP

<?php
$ch = curl_init('https://api.mozout.com/v1/account/users');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('RLX_API_KEY'),
        'Accept-Language: en',
    ],
]);
$body = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo $status, PHP_EOL, $body, PHP_EOL;

Python

import os
import requests

headers = {
    "Authorization": "Bearer " + os.environ["RLX_API_KEY"],
    "Accept-Language": "en",
}
r = requests.get("https://api.mozout.com/v1/account/users", headers=headers, timeout=30)
print(r.status_code)
print(r.text)

JavaScript

const response = await fetch("https://api.mozout.com/v1/account/users", {
  headers: {
    Authorization: `Bearer ${process.env.RLX_API_KEY}`,
    "Accept-Language": "en",
  },
});
console.log(response.status);
console.log(await response.text());

Responses

200

List the users.

{
  "data": [
    {
      "id": 35,
      "first_name": "Ana",
      "last_name": "Silva",
      "email": "[email protected]",
      "owner": true,
      "two_factor_enabled": false,
      "permissions": [],
      "last_login_at": "2026-11-04T09:30:00+02:00"
    }
  ],
  "meta": {
    "page": 1,
    "per_page": 10,
    "total": 1,
    "total_pages": 1
  }
}

Header	Description
`X-Correlation-ID`	Identifier of this request. Give it to support when you report a problem.
`X-RateLimit-Limit`	Requests allowed per minute.
`X-RateLimit-Remaining`	Requests left in the current minute.
`X-RateLimit-Reset`	When the minute ends, as a Unix timestamp in seconds.
`X-API-Mode`	The mode of the key that made the request: `sandbox` or `production`.

401

The key is missing, invalid, revoked or expired, or the user who created it no longer has access to the account.

{
  "error": {
    "code": "unauthorized",
    "message": "Missing or invalid API key.",
    "correlation_id": "0f8fad5b-d9cb-469f-a165-70867728950e",
    "details": {}
  }
}

403

The account cannot use the API (forbidden), the key lacks the permission (insufficient_scope), or the IP address is not on the list of the key (ip_not_allowed).

{
  "error": {
    "code": "insufficient_scope",
    "message": "This key does not have the required permission.",
    "correlation_id": "0f8fad5b-d9cb-469f-a165-70867728950e",
    "details": {
      "required": "dns:read"
    }
  }
}

422

Some of the data is not valid.

{
  "error": {
    "code": "validation_failed",
    "message": "Some of the data is not valid.",
    "correlation_id": "0f8fad5b-d9cb-469f-a165-70867728950e",
    "details": {}
  }
}

429

Too many requests. Wait for the time in Retry-After.

{
  "error": {
    "code": "rate_limited",
    "message": "Too many requests. Please try again shortly.",
    "correlation_id": "0f8fad5b-d9cb-469f-a165-70867728950e",
    "details": {
      "retry_after": 42
    }
  }
}

Header	Description
`Retry-After`	Seconds to wait before trying again.

500

An internal error occurred. Give the correlation_id to support.

{
  "error": {
    "code": "internal_error",
    "message": "An internal error occurred. Please give the correlation_id to support.",
    "correlation_id": "0f8fad5b-d9cb-469f-a165-70867728950e",
    "details": {}
  }
}

503

The API is turned off.

{
  "error": {
    "code": "disabled",
    "message": "The API is currently turned off.",
    "correlation_id": "0f8fad5b-d9cb-469f-a165-70867728950e",
    "details": {}
  }
}

Errors

Status	Code	Meaning
401	`unauthorized`	The key is missing, invalid, revoked or expired, or the user who created it no longer has access to the account.
403	`forbidden`, `insufficient_scope`, `ip_not_allowed`	The account cannot use the API (`forbidden`), the key lacks the permission (`insufficient_scope`), or the IP address is not on the list of the key (`ip_not_allowed`).
422	`validation_failed`	Some of the data is not valid.
429	`rate_limited`	Too many requests. Wait for the time in Retry-After.
500	`internal_error`	An internal error occurred. Give the correlation_id to support.
503	`disabled`	The API is turned off.

The error format is explained in Errors.