Programmatic API (partner API keys)¶
Partners can script against their own account with an API key that authenticates as a partner_admin
scoped to that partner.
Keys¶
Create a key in the portal (Clients list → API keys). It's shown once; only a salted hash is stored, and it can be revoked at any time. Use it as a bearer token:
Authorization: Bearer tpk_xxxxxxxx...
A key can do anything a partner admin can via the same /v1/* endpoints — it just can't mint other API
keys. Manage keys: GET/POST /v1/partner/apikeys, POST /v1/partner/apikeys/:id/revoke.
Common endpoints¶
| Purpose | Call |
|---|---|
| List your clients | GET /v1/clients |
| Create a client | POST /v1/clients { name } |
| Client's machines | GET /v1/machines?tenant=<clientId> |
| Client's runs | GET /v1/runs?tenant=<clientId> |
| Analytics | GET /v1/analytics?tenant=<clientId> |
| Hardware / software inventory | GET /v1/inventory?tenant=…&q=, GET /v1/software?tenant=…&q= |
| Patch posture | GET /v1/patches?tenant=<clientId> |
| Queue a command | POST /v1/commands { tenantId, serial, type } |
| Bulk command | POST /v1/commands/bulk { tenantId, type, tag? } |
| Manage webhooks | GET/POST /v1/webhooks |
| Export a client | GET /v1/clients/:id/export |
All responses are JSON. Client-scoped reads accept ?tenant=<clientId>; writes take tenantId in the
body. A key only sees clients under its own partner.
Rate limits¶
Public endpoints (signup, machine enroll) are rate-limited per IP in a fixed window; exceeding the window returns HTTP 429. The authenticated management API is not rate-limited today.