Private applications

A private application accesses the Riseact APIs with a static token, without the OAuth flow. It is meant for scripts, backend integrations and internal tools.

Creating a private application

1. In the administration panel go to Settings > Apps > Private applications.
2. Click New private application.
3. Give it a name, for example "CRM Sync".
4. Select the permissions.
5. Click Create.

The access token is shown only once: copy it right away. It is tied to the organization and does not expire.

caution

Treat the token like a password: keep it out of versioned code.

Using the token

The token goes in every request, in the Authorization header, for both GraphQL and REST:

Authorization: Bearer <IL_TUO_TOKEN>

GraphQL

curl -X POST https://core.riseact.org/admin/graphql/ \
  -H "Authorization: Bearer IL_TUO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"query": "query { organization { name domain } }"}'

REST

curl https://core.riseact.org/api/v1/supporters/ \
  -H "Authorization: Bearer IL_TUO_TOKEN"

Pagination and ordering: see REST pagination.

Permissions

The application accesses only the resources it has permissions for, in the entity:action format.

Permission	Description
supporter:read	Read supporters
supporter:write	Create and edit supporters
supporter:export	Export supporters
donation:read	Read donations
donation:write	Create and edit donations
donation:export	Export donations
payment:read	Read payments
payment:write	Create and edit payments
campaign:read	Read campaigns
campaign:write	Create and edit campaigns
project:read	Read projects
project:write	Create and edit projects
activity:read	Read activities
activity:write	Create and edit activities
reports:read	Access to reports
application:read	Read installed applications
application:install	Install applications
sitefront:themes	Manage site themes
sitefront:themes.code	Edit theme code
sitefront:content	Manage site content
sitefront:navigation	Manage site navigation
dbox:read	Read donation boxes
dbox:write	Create and edit donation boxes

Without the permission the operation requires, the response is an authorization error. :write does not include :read: to read and write supporters you need both supporter:read and supporter:write.

Regenerating the token

If the token is compromised, regenerate it from Settings > Apps > Private applications: the previous one stops working immediately.

Difference from partner apps

Feature	Private application	Partner app
Access	Single organization	All orgs that install the app
Authentication	Static token, no expiration	OAuth 2.0 with PKCE, temporary tokens
Token management	Manual by admin	Automatic via refresh token
Typical use case	Internal automations, scripts	Third-party integrations