API

API reference

Two read-only public endpoints ship today. The authenticated REST API, issued API keys, idempotency keys, signed outgoing webhooks and retry history are on the roadmap — they are not available yet.

Available today

GET/api/public/v1/rfqsMarketplace feed of published, public RFQs. Read-only, safe field projection.
GET/api/public/v1/receipts/:id?hash=<64-hex>Verify a clearance receipt by ID + SHA-256 hash. Returns only integrity metadata (decision, issued-at, mandate / policy versions). Never returns the persisted hash, transaction value, or supplier identity.

These endpoints return only non-sensitive fields. Application-level rate limiting is on the roadmap and is not enforced today — treat them as public reads.

Roadmap · not yet available

Planned authenticated REST endpoints

POST/api/v1/rfqsCreate a draft RFQ (structured or natural-language brief).
POST/api/v1/rfqs/:id/publishPublish an RFQ to invited suppliers or the marketplace.
GET/api/v1/rfqs/:id/quotesList quotations received for an RFQ (buyer scope).
POST/api/v1/clearances/evaluateEvaluate a proposed award against agent mandate and policy.
POST/api/v1/approvals/:id/decisionApprove, reject or request changes with a written reason.
POST/api/v1/ordersConvert a cleared quote into a purchase order.
GET/api/v1/agents/:id/authorityReturn remaining daily and monthly authority for an agent.

Roadmap · not yet available

Planned webhooks

Once shipped, outgoing webhooks will be HMAC-signed and retried with exponential backoff; delivery history will surface in settings. None of these are delivered today.

rfq.publishedquote.receivedclearance.clearedclearance.approval_requiredclearance.rejectedapproval.completedorder.created

The full authenticated REST API and outgoing webhooks are on the roadmap and not yet available. A support contact channel has not been configured for this sandbox build.