Partner API
Authenticated REST for your chain data.
Tenant API keys, partner-data exports, and webhooks on the production Nest API. This is not a public unauthenticated API and not GraphQL.
Who this is for
Organisation desks and their partners.
Desk managers create and revoke API keys. Partner systems call partner-data and webhooks with a Bearer token. Dashboard browser cookies are not partner auth.
Auth
Bearer JWT or a tbk_live_ key.
Send Authorization: Bearer with a signed-in user JWT or a tenant API key that starts with tbk_live_. Creating or revoking keys needs a signed-in desk user. An API key cannot manage other keys.
Base URL
Production API with /api prefix.
Call the production API host and keep the /api prefix. OpenAPI paths are relative to that base. A sandbox server entry is reserved for later and is not live today.
Scopes
Key scopes and partner-data scopes.
API keys use read and write. Partner-data calls also need an explicit dataset scope: read:lineage, read:compliance, read:risk, or read:shipments.
Webhooks
Register and inspect deliveries.
Register a webhook and list delivery attempts for that registration. Keep secrets out of client logs and revoke keys when a partner leaves.
Errors
Standard HTTP status codes.
Expect 400 for validation failures, 401 when the token is missing or invalid, and 403 when tenant or role policy blocks the call. Error bodies match the OpenAPI schemas.
Out of scope
What this page does not document.
Dashboard browser APIs, marketing lead forms, direct database access, GraphQL, and unauthenticated product APIs are not part of the partner surface.