Auth and Reporting

Auth model

Partner API access uses bearer tokens scoped to the approved integration surface. The public contract is intentionally high level:

• partner identity is bound to the token, not supplied by a browser header,
• machine clients and interactive sessions are separated,
• tokens are scoped to the routes and partner context agreed during onboarding,
• onboarding details are handled in partner diligence, not public docs.

Reporting routes

Partner-scoped reporting covers:

• GET /v1/quotes/{quote_id}/evidence
• GET /v1/transactions/{id}
• GET /v1/batches/{batch_id}/settlement
• GET /v1/batches/{batch_id}/payout-instructions
• GET /v1/metrics/expiry-payout

Those routes are intended to answer practical finance and support questions: what was quoted, what was accepted, what has settled, and what still needs action.

Next step

Read the architecture summary for the public diligence view of the boundary behind these surfaces.