Private applications

Private applications allow you to access the Riseact APIs through a static token without having to implement the OAuth flow. They are suitable for automation scripts, backend-to-backend integrations and internal tools where there is no human user performing the login.

Creating a private application

1. Log in to the administration panel of your Riseact organization.
2. Go to Settings → Apps → Private applications.
3. Click on New private application.
4. Assign a descriptive name (e.g. "CRM Sync", "Nightly export").
5. Select the permissions you want to grant to the application (see the permissions section below).
6. Click on Create.

After creation, the access token will be shown. Copy it and store it securely: it will not be shown again. The token is associated with the current organization and does not expire.

caution

Treat the token like a password. Never include it in versioned code or in publicly exposed environment variables.

Using the token

The token must be included in every request as the Authorization HTTP header:

Authorization: Bearer <IL_TUO_TOKEN>

The header is identical for both the GraphQL APIs and the REST APIs.

GraphQL

curl -X POST https://core.riseact.org/admin/graphql/ \
  -H "Authorization: Bearer IL_TUO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"query": "query { organization { name domain } }"}'

REST

curl https://core.riseact.org/api/v1/supporters/ \
  -H "Authorization: Bearer IL_TUO_TOKEN"

The REST APIs support standard pagination and ordering parameters. For more details, see the REST pagination guide.

Permissions

Each private application accesses only the resources for which it received explicit authorization at creation time. Permissions follow the format entity:action.

Permission	Description
supporter:read	Read supporters
supporter:write	Create and edit supporters
supporter:export	Export supporters
donation:read	Read donations
donation:write	Create and edit donations
donation:export	Export donations
payment:read	Read payments
payment:write	Create and edit payments
campaign:read	Read campaigns
campaign:write	Create and edit campaigns
project:read	Read projects
project:write	Create and edit projects
activity:read	Read activities
activity:write	Create and edit activities
reports:read	Access to reports
application:read	Read installed applications
application:install	Install applications
sitefront:themes	Manage site themes
sitefront:themes.code	Edit theme code
sitefront:content	Manage site content
sitefront:navigation	Manage site navigation
dbox:read	Read donation boxes
dbox:write	Create and edit donation boxes

How permissions are checked

Each API operation requires one or more specific permissions. When a request arrives with the token, the system verifies that the permissions granted to the application include those required by the operation. If the check fails, the response is an authorization error.

:write permissions do not implicitly include the corresponding :read: if your application needs to both read and write supporters, select both supporter:read and supporter:write.

Regenerating the token

If the token is compromised, you can regenerate it from the same administration page (Settings → Apps → Private applications). Regeneration immediately invalidates the previous token.

Difference from partner apps

Feature	Private application	Partner app
Access	Single organization	All orgs that install the app
Authentication	Static token, no expiration	OAuth 2.0 with PKCE, temporary tokens
Token management	Manual by admin	Automatic via refresh token
Typical use case	Internal automations, scripts	Third-party integrations