The PASTOR API uses bearer token authentication. All requests must include a valid token in the Authorization header.
Obtaining a token
API access is provisioned by the PASTOR team. To request a token, email developers@pastormap.com with a description of your use case and the municipalities your integration needs to access. The team will respond with your bearer token and the applicable access permissions.
Token types
| Type | Prefix | Use case |
|---|---|---|
| Live token | pk_live_ |
Production integrations |
| Test token | pk_test_ |
Development and testing without consuming quota |
Test tokens return realistic mock data and do not count toward your rate limits.
Sending the token
Include the token in the Authorization header of every request:
GET /api/v3/m1?municipio_id=05001&date_from=2025-07-01&date_to=2025-07-28 HTTP/1.1
Host: api.pastormap.com
Authorization: Bearer pk_live_your_token_hereNever send tokens as query parameters. They appear in server logs and browser history.
Scopes
Each token has one or more scopes that control which endpoints it can access. Scopes are assigned by the PASTOR team when your token is provisioned.
| Scope | Description |
|---|---|
risk:read |
Read risk scores and historical data |
reports:read |
Download report files |
reports:write |
Generate new reports |
ecosystem:read |
Access ecosystem and vegetation data |
Request the minimum set of scopes needed for your integration when contacting the team.
Rate limits
Rate limits are applied per token and vary by endpoint type:
| Endpoint type | Limit |
|---|---|
Analysis endpoints (/api/v3/m1, /api/v3/m10, /api/v3/m3, /api/v3/decisiones, /api/v1/framing, /ecosystem) |
100 requests per minute |
Report generation (/api/v1/report) |
10 requests per minute |
When you exceed the rate limit, the API returns HTTP 429 Too Many Requests. The response includes Retry-After and X-RateLimit-Reset headers indicating when the limit resets.
HTTP/1.1 429 Too Many Requests
Retry-After: 12
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1722153612Revoking a token
If a token is compromised, contact developers@pastormap.com immediately to have it revoked. Obtain a replacement token before the old one is deactivated to avoid downtime.
Never commit tokens to version control. Use environment variables or a secrets manager.
IP allowlisting (enterprise)
Enterprise access supports restricting token usage to a list of IP addresses or CIDR ranges. Contact developers@pastormap.com to configure IP restrictions for your account.