Skip to main content
All API requests (except /health) require a valid API key passed as a Bearer token in the Authorization header.

​
API key format

​
Making authenticated requests

Pass your key in the Authorization header with the Bearer scheme:

​
Environments

A key belongs to exactly one environment. Each environment has its own database, and a key only exists in the one it was issued from — so a cmp_test_ key returns 401 against production, and a cmp_live_ key returns 401 against the sandbox. There is no key that works in both. Build against the sandbox first. Its data is non-production and safe to hammer, and the request and response shapes are identical to production, so moving over is a change of base URL and key, nothing else. When you are ready for production, ask your account manager for a cmp_live_ key. It is issued separately; production keys cannot be generated from sandbox.

​
Data scoping

Each API key is scoped to a partner account. You will only see contracts and suppliers that your partner account has been granted access to. If you need access to additional data, contact your account manager.

​
Key rotation

Rotation takes effect immediately. The replacement is issued and the old key is revoked in the same step, so there is no overlap window and no grace period — the old key starts returning 401 the moment the new one is created. Plan for that: have the deployment of the new key ready before requesting the rotation, so the gap is as short as possible.
  1. Ask your account manager to rotate the key, and agree a time
  2. Receive the replacement, which is shown once and cannot be retrieved later
  3. Deploy it
If you only need to retire a key you have already replaced, ask for a revoke instead of a rotate.

​
Error responses

If your key is missing, invalid, or revoked:
Data outside your partner scope is filtered out rather than refused. A collection returns 200 with the out-of-scope rows absent, and a single out-of-scope record returns 404 — the same as one that does not exist, so the API never confirms whether a record you cannot see is real. An empty data array therefore means “nothing in your scope matched”, which can mean the filters excluded everything, or that your account has not been granted the relevant contracts, co-ops or suppliers yet. If you expect results and get none, check your scope with your account manager before debugging the query.