Build on it / Partner API
A partner API where every key has a scope
The partner API reads claims, a single claim, its payments, its document list, contacts and the event stream — each behind its own scope, under keys your administrator issues and can revoke.
An API that bypasses the permission model is not an API, it is a hole. The organization comes from the key, never from a parameter, and the database walls sit underneath every call.
The question this answers
What stops a key reaching further than it should?
Its scopes. A key is issued with the scopes you choose. While the platform is in observe mode, a key reaching outside them is listed with what it tried and how often; once switched to enforce, the reach is refused from the next request.
How programmatic access is governed
Scoped, limited, recorded
01
Keys Per Organization
Up to 10, created by your administrator tier under the Integration Gateway entitlement. A key is shown once.
02
Scopes Per Key
Claims, one claim, payments, document list, contacts, events — and nothing outside them.
03
Limits Per Key
An optional daily limit, up to 1,000,000, and a burst guard — 120 requests a minute by default — that can be changed but never removed.
04
Walls Underneath
The organization comes from the key. Forced row-level security applies to every call, as it does to every person.
05
An Event Stream
With events.read, a partner reads your organization’s claim and payment events on from the last one it saw.
For a developer evaluating this
The ground rules
Ask us for the reference and we will give you the real one rather than a marketing summary.
Authentication
Partner API keys, scoped, revocable
Tenancy
From the key; no organization parameter is accepted
Documents
The list only, never the files
Contacts
Never tax numbers
Write Doors
Check-status feeds, vendor invoices and agency submissions come in through their own keyed doors
Enforcement
Observe mode lists out-of-scope reaches; enforce mode refuses them
Where we are honest
Where we are honest with developers
A developer will find these out in week one. Better they hear them from us in week zero.
Mostly A Read API
The partner API reads. Writing claims and payments happens through the platform’s own doors, and a few keyed feeds.
No Public Sandbox Yet
Evaluation happens in a provisioned environment with us rather than a self-service sandbox you can sign up for today.
Not Every Screen Has A Door
Ask specifically about the workflow you intend to automate, and we will tell you which doors exist.
Read next
Bring the integration you want to build
Describe it concretely and we will tell you which scopes and events exist, which do not, and what we would have to build.