Skip to main content
For AI agents: a documentation index is available at https://docs.coverbase.com/llms.txt. This page is also available in markdown by appending .md to the URL.
The Coverbase API uses bearer token authentication. Every request must include a credential in the Authorization header. For the full set of cross-cutting rules (IDs, timestamps, idempotency, error envelope) see API conventions.
API keys grant significant access to your TPRM data. Never share them in public repositories, client-side code, screenshots, or support tickets. Treat them like passwords.

​
Request an API key

An admin in your organization creates API keys on the API keys page (Configuration, under Developers and integrations) or through the API Keys API. Each key looks like ak_..., is scoped to a single organization, and authenticates as a service account. All data it can read or write is implicitly scoped to that org. Ask your admin for one. A logged-in user JWT (the dashboard session token) is also accepted, which is convenient for first-party scripts running as a user. By default a key carries no elevated permissions and can only call ordinary /v1/* routes. An admin can also mint a key with admin scopes: keys:manage (manage ak_* keys), audit:read (read the system audit log), banking:read (read full supplier bank and tax identifiers), and review:sensitive_changes (approve queued bank-detail changes). The admin-JWT path still works for the key and audit-log endpoints. See API key scopes and the API Keys reference.

​
Base URLs

See API conventions → Base URLs.

​
Authorization header

Include your key as a bearer token in every request:

​
Test your connection

Use the /v1/utils/authtest endpoint to verify three things at once: your key is valid, you can reach Coverbase’s servers, and your firewall or proxy allows outbound HTTPS traffic.
A successful request returns 200 OK:

​
Common errors

Your credential is malformed, expired, or revoked (Invalid or expired API key. for an ak_ key), or its role is not permitted on the endpoint (Unauthorized role.). Confirm the key is active and that the endpoint accepts API keys.
A request with no Authorization header, or with a scheme other than Bearer, returns 403 with Not authenticated. Otherwise your credential is valid but not authorized for what it tried to do: most often an ak_* key calling an admin endpoint without the required scope (insufficient_scope), or a non-admin caller trying to grant scopes when creating a key (scope_grant_forbidden). A configured API IP allowlist can also return 403 ip_not_allowed. See API key scopes.
The resource does not exist, or it belongs to a different organization than your API key. All data is org-scoped to the key.
Check your VPN, proxy, and firewall rules. Coverbase requires outbound HTTPS access to api.coverbase.app.
Unauthenticated requests are rejected. There is no public unauthenticated surface area on the API.