{ "openapi": "3.1.1", "info": { "title": "Redque Peppol Production Partner API", "description": "Setting up what a partner sends and receives: API keys (its own, and its End Users'), End Users, participant registration, webhooks and served jurisdictions.", "version": "1.0.0" }, "servers": [ { "url": "https://partnerapi.peppol.redque.com/" } ], "paths": { "/v1/api-keys": { "get": { "tags": [ "API keys" ], "summary": "List the partner's API keys.", "description": "Metadata for key slots 1 and 2: key ID, creation time and origin, expiry and last use. The keys themselves are never returned. currentSlot is the slot of the key used for this call, so you know which slot is safe to rotate.", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiKeysResponse" } } } } } } }, "/v1/jurisdictions": { "get": { "tags": [ "Jurisdictions" ], "summary": "List the countries Redque serves End Users in, with their Peppol rules.", "description": "Each country's Peppol Authority can set specific requirements (PASR) for End Users established there. For every served\njurisdiction this lists:\n\n- `identifierSchemes`: the participant ID schemes End Users may be registered with, with an example.\n- `defaultDocumentTypes` / `mandatoryDocumentTypes`: capabilities registered when you do not choose, and those always registered.\n- `supportedCapabilities`: every document type and process End Users here can be registered for and exchange, in the form\n participant registration takes (`capabilities`), e.g. BIS Self-Billing, which is never a default.\n- `centralisedSmp`: participants are published in the national centralised SMP instead of Redque's SMP.\n- `deregistrationWorkingDays`: deadline for removing a participant from its SMP, e.g. when an End User switches Service Provider.\n- `peppolAuthority`: the authority and the PASR version implemented; null when the country has no specific requirements.\n\nEnd Users in countries not listed cannot be created.", "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/JurisdictionSummary" } } } } } } } }, "/v1/end-users": { "post": { "tags": [ "End Users" ], "summary": "Create an End User.", "description": "Creates a business you serve (the Peppol End User).\n\n- `countryCode` (required): country of establishment. It selects the jurisdiction whose Peppol rules apply to the End User:\n allowed participant ID schemes, where participants are published, deadlines. Only jurisdictions listed by\n `GET /v1/jurisdictions` are served.\n- `legalForm`: `Company` (default), `SelfEmployed` or `PublicBody`.\n- `ico`: company ID (e.g. Czech IČO), stored for your reference.\n- `externalRef`: your own reference, unique per partner.\n\nErrors: `400` missing fields, `409` duplicate `externalRef`, `422` country not served.", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateEndUserRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } }, "get": { "tags": [ "End Users" ], "summary": "List End Users.", "description": "All End Users of the calling partner, oldest first.", "responses": { "200": { "description": "OK" } } } }, "/v1/end-users/{endUserId}": { "put": { "tags": [ "End Users" ], "summary": "Update an End User.", "description": "Changes the details that describe an End User: its `name`, your `externalRef`, and its address (`street`, `city`,\n`postCode`). Send the complete set — anything left out is cleared.\n\n`countryCode`, `ico` and `legalForm` cannot be changed, because they are what the End User *is* rather than how it is\ndescribed: the country decides which identifier schemes its participants may use and where they are published, the company\nID identifies the business in the Peppol Directory, and the legal form changes how some jurisdictions treat it. If one of\nthem is wrong, create the End User you meant.\n\nThe name and address appear on the Peppol Directory business card, so a listed End User is re-published automatically.\n\nErrors: `400` missing `name` or an address field over 200 characters, `404` unknown End User, `409` duplicate `externalRef`.", "parameters": [ { "name": "endUserId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateEndUserRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } } }, "/v1/end-users/{endUserId}/participants": { "get": { "tags": [ "End Users" ], "summary": "List an End User's participants.", "description": "Every Peppol participant registered for this End User, by identifier.\n\nParticipants that are no longer active are included; check `state`. `Live` can send and receive, `Suspended` is hidden from\nsenders, and `Deregistered` no longer receives anything — a deregistered identifier stays listed as the record that it was once yours.\n\nReturns `404` for End Users of other partners.", "parameters": [ { "name": "endUserId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "OK" } } } }, "/v1/participants": { "post": { "tags": [ "Participants" ], "summary": "Register a Peppol participant for an End User.", "description": "Makes an End User reachable on the Peppol network, so other companies can send it invoices and credit notes.\n\nThe participant ID is the address senders use. Which schemes are accepted depends on the End User's country; see\n`GET /v1/jurisdictions`. For example:\n- Czech End Users: `9929:CZ12345678` (DIČ; for self-employed people it usually differs from CZ + IČO, and both are accepted)\n or `0088:5798000000001` (GLN).\n- Slovak End Users: only `0245:2020123456` (Slovak DIČ).\n\n**Ownership is your responsibility.** Before registering, verify that the End User is the rightful holder of the participant ID,\nthen send `ownershipConfirmed: true`. Redque does not check ownership: it records your confirmation (when, and with which API\nkey) with the participant. A participant ID registered for the wrong company receives that company's documents.\n\nRegistration has two steps, visible in `state`:\n1. `SmpRegistered`: immediately. The registration is being published in the directory (SMP) senders look up. For most\n countries that is Redque's SMP, registered in the central Peppol registry (SML); some countries require their national\n centralised SMP instead (e.g. Slovakia).\n2. `Live`: once published. This usually takes seconds; poll `GET /v1/participants/{participantId}`. Sending documents requires `Live`.\n\n**Slovakia** adds a step before these: only the End User can authorise Redque, by choosing Redque as its Service Provider on\nthe Financial Administration's portal. Until the portal's confirmation reaches Redque the participant stays `Requested` and\ncannot receive anything; it then continues to `SmpRegistered` and `Live` by itself. If the End User chose Redque before you\nregister, registration goes straight to `SmpRegistered`. In the sandbox, `POST /v1/sandbox/sk/provider-selections` stands\nin for the portal.\n\n`capabilities` (the document types the participant can receive) default to every type Redque supports.\n\nErrors:\n- `404`: unknown End User.\n- `409`: the participant ID is already registered, by anyone: IDs are unique across the whole Peppol network.\n- `422`: `ownershipConfirmed` is not true, a participant ID not allowed in the End User's jurisdiction, the jurisdiction is not\n served, or unsupported capabilities.", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegisterParticipantRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } } }, "/v1/participants/{participantId}": { "get": { "tags": [ "Participants" ], "summary": "Get a participant.", "description": "Registration `state` and `capabilities` of one of your participants.\n\nStates: `SmpRegistered` → `SmlPropagated` (briefly) → `Live` (can send and receive) ⇄ `Suspended` (not discoverable by senders);\n`Deregistered` no longer receives anything, and registering the identifier again starts it over.\nReturns `404` for participants of other partners.", "parameters": [ { "name": "participantId", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } } }, "delete": { "tags": [ "Participants" ], "summary": "Deregister a participant.", "description": "Removes the participant from the Peppol network: it is taken out of the directory (SMP) it was published in, so it can no\nlonger receive documents. Some jurisdictions set a deadline for this (e.g. Slovakia: 3 working days when switching Service\nProvider).\n\nThe participant ends `Deregistered` and stops receiving immediately. Documents already in its inbox remain available, and\nstay yours. The identifier is not burnt: registering it again starts a fresh registration, which is how an End User moving\nto another Service Provider works.", "parameters": [ { "name": "participantId", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } } } }, "/v1/participants/{participantId}/capabilities": { "put": { "tags": [ "Participants" ], "summary": "Change what a participant can receive.", "description": "Replaces the document types the participant is registered for. Send the complete set you want: anything left out stops\nbeing advertised, so senders can no longer address it.\n\nThe same rules as registration apply, and your End User's jurisdiction may add types it requires. Send at least one:\na participant reachable for nothing cannot receive.\n\nSenders see the change as soon as it is made; those who already looked the participant up may keep using what they cached.\n\nErrors: `404` unknown participant, `409` the participant is deregistered (register it again instead), `422` a document type\nwe do not publish or an empty set.", "parameters": [ { "name": "participantId", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SetCapabilitiesRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } } }, "/v1/participants/{participantId}/suspend": { "post": { "tags": [ "Participants" ], "summary": "Suspend a participant.", "description": "Temporarily hides the participant from senders: the directory (SMP) stops publishing where to deliver its documents, so no new\ndocuments can be addressed to it. Documents already on their way are still received into its inbox.\n\nOnly a `Live` participant can be suspended (`409` otherwise). Undo with `POST /v1/participants/{participantId}/resume`.", "parameters": [ { "name": "participantId", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } } } }, "/v1/participants/{participantId}/resume": { "post": { "tags": [ "Participants" ], "summary": "Resume a suspended participant.", "description": "Makes a `Suspended` participant `Live` again: senders can find it and send it documents.\n\nReturns `409` when the participant is not `Suspended`.", "parameters": [ { "name": "participantId", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" } } } }, "/v1/participants/{participantId}/directory": { "put": { "tags": [ "Participants" ], "summary": "List or unlist the End User in the Peppol Directory.", "description": "The Peppol Directory (`directory.peppol.eu`) lets senders find a business by name instead of by identifier. Listing publishes\nthe End User's **name, country of establishment, address, company number and registration date** — nothing else, and never\nyour own contact details. The End User needs at least a city before it can be listed (`422` otherwise): a name and a country\nalone cannot tell two companies apart. Change the address later with `PUT /v1/end-users/{endUserId}` and the listing follows.\n\n- `optIn: true` lists the End User once its participant is `Live`; a participant registered but not yet live is listed as soon\n as it goes live.\n- `optIn: false` removes the listing again.\n\nOnly ask for a listing with the End User's agreement: the entry is public, and for a self-employed person the name, tax\nnumber and address are personal data — the address is often a home address. A suspended or deregistered participant is\nremoved from the Directory automatically.\n\nParticipants published in a national centralised SMP (e.g. Slovakia) are listed by that SMP, not by Redque, so this has no\neffect for them.", "parameters": [ { "name": "participantId", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DirectoryListingRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } } }, "/v1/webhooks": { "post": { "tags": [ "Webhooks" ], "summary": "Create a webhook subscription.", "description": "Registers an https URL that receives transmission.status and document.received events as JSON POSTs. Each delivery is signed: X-Redque-Signature is v1= followed by hex HMAC-SHA256(secret, \"{X-Redque-Timestamp}.{body}\"); X-Redque-Event and X-Redque-Delivery identify the event and delivery. Failed deliveries are retried with exponential backoff (up to 12 attempts), and the inbox remains the fallback. The signing secret is returned only in this response.", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateWebhookRequest" } } }, "required": true }, "responses": { "200": { "description": "OK" } } }, "get": { "tags": [ "Webhooks" ], "summary": "List webhook subscriptions.", "description": "The partner's subscriptions, including deactivated ones. Signing secrets are never returned here.", "responses": { "200": { "description": "OK" } } } }, "/v1/webhooks/{subscriptionId}": { "delete": { "tags": [ "Webhooks" ], "summary": "Deactivate a webhook subscription.", "description": "Stops deliveries to the subscription's URL. The subscription remains listed as inactive. Returns 204, or 404 when it does not belong to the partner.", "parameters": [ { "name": "subscriptionId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "OK" } } } }, "/v1/api-key-rotations": { "post": { "tags": [ "API keys" ], "summary": "Request an API key rotation code.", "description": "Emails a one-time code for the given key slot (1 or 2) to the partner's contact address on record. No API key is needed, so this also recovers lost or expired keys. Always returns 202, whether or not a code was sent; codes are sent only to active partners, at most 3 per hour, and requesting a new code invalidates the pending one. The key currently in the slot keeps working until the code is confirmed. Returns 400 for an invalid slot, 429 when rate limited and 503 when email is unavailable.", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RequestKeyRotationRequest" } } }, "required": true }, "responses": { "202": { "description": "Accepted" }, "400": { "description": "Bad Request", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ ] } }, "/v1/api-key-rotations/confirm": { "post": { "tags": [ "API keys" ], "summary": "Confirm an API key rotation.", "description": "Redeems the emailed code (valid 15 minutes, single use, locked after 5 wrong attempts) and issues a new key into the slot. The new key is returned only in this response; the slot's previous key stops working immediately and the other slot is not affected. A rotation notice is emailed to the contact address. Returns 400 for a wrong, expired or used code and 429 when rate limited.", "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConfirmKeyRotationRequest" } } }, "required": true }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiKeyIssuedResponse" } } } }, "400": { "description": "Bad Request", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } }, "security": [ ] } }, "/v1/end-users/{endUserId}/api-keys": { "get": { "tags": [ "End User API keys" ], "summary": "List an End User's API keys.", "description": "Metadata for key slots 1 and 2 of one of your End Users: key ID, creation time and origin, expiry and last use. The keys\nthemselves are never returned — a key is shown only in the response that issues it.\n\n`lastUsedAt` is what tells you which slot the End User's software is actually using, so you know which one is safe to\nrotate. It is written at most once every five minutes.\n\nReturns `404` for End Users of other partners.", "parameters": [ { "name": "endUserId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ApiKeyInfo" } } } } } } } }, "/v1/end-users/{endUserId}/api-keys/{slot}/rotate": { "post": { "tags": [ "End User API keys" ], "summary": "Issue an API key for an End User.", "description": "Issues a key into slot 1 or 2 for one of your End Users and returns it **once** — it is never retrievable afterwards. This is\nhow an End User gets its first key, and how it gets a new one.\n\nAn End User key (`rqe_…`) authenticates the document exchange API only: submission, status, inbox and participant lookup, for\nthis one End User's participants. It is not accepted here, and your own partner key is not accepted there.\n\nThe key already in the slot stops working immediately; the other slot is untouched, which is what lets you hand over a new\nkey before retiring the old one. Keys expire after 365 days.\n\nThere is no self-service rotation for End Users: you issue and rotate their keys, and hand them over yourself. Redque never\nemails an End User.\n\nErrors: `400` a slot other than 1 or 2, `404` unknown End User or one of another partner.", "parameters": [ { "name": "endUserId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "slot", "in": "path", "required": true, "schema": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": "integer", "format": "int32" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiKeyIssuedResponse" } } } }, "400": { "description": "Bad Request", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } } } } }, "/v1/end-users/{endUserId}/api-keys/{slot}": { "delete": { "tags": [ "End User API keys" ], "summary": "Revoke an End User's API key.", "description": "Deletes the key in the slot, which stops working immediately. Use it when a key leaks, or to cut an End User off: an End User\nwith no keys cannot send or receive through the API, while its participants stay registered and keep receiving documents into\nthe inbox.\n\nErrors: `404` empty slot, unknown End User, or one of another partner.", "parameters": [ { "name": "endUserId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "slot", "in": "path", "required": true, "schema": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": "integer", "format": "int32" } } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "ApiKeyInfo": { "required": [ "slot", "keyId", "createdAt", "createdBy", "expiresAt", "lastUsedAt" ], "type": "object", "properties": { "slot": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32" }, "keyId": { "type": "string" }, "createdAt": { "type": "string", "format": "date-time" }, "createdBy": { "type": "string" }, "expiresAt": { "type": "string", "format": "date-time" }, "lastUsedAt": { "type": [ "null", "string" ], "format": "date-time" } } }, "ApiKeyIssuedResponse": { "required": [ "slot", "keyId", "apiKey", "expiresAt" ], "type": "object", "properties": { "slot": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32" }, "keyId": { "type": "string" }, "apiKey": { "type": "string" }, "expiresAt": { "type": "string", "format": "date-time" } } }, "ApiKeysResponse": { "required": [ "currentSlot", "keys" ], "type": "object", "properties": { "currentSlot": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32" }, "keys": { "type": "array", "items": { "$ref": "#/components/schemas/ApiKeyInfo" } } } }, "CapabilityRequest": { "required": [ "documentTypeId", "processId" ], "type": "object", "properties": { "documentTypeId": { "type": "string" }, "processId": { "type": "string" } } }, "CapabilitySummary": { "required": [ "documentTypeId", "processId" ], "type": "object", "properties": { "documentTypeId": { "type": "string" }, "processId": { "type": "string" } } }, "ConfirmKeyRotationRequest": { "required": [ "partnerId", "slot", "code" ], "type": "object", "properties": { "partnerId": { "type": "string", "format": "uuid" }, "slot": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32" }, "code": { "type": "string" } } }, "CreateEndUserRequest": { "required": [ "name", "countryCode", "ico", "externalRef" ], "type": "object", "properties": { "name": { "type": "string" }, "countryCode": { "type": "string", "description": "Country of establishment (ISO 3166-1 alpha-2). Selects the jurisdiction whose Peppol rules apply; see GET /v1/jurisdictions." }, "ico": { "type": [ "null", "string" ] }, "externalRef": { "type": [ "null", "string" ] }, "legalForm": { "description": "Company (default), SelfEmployed or PublicBody. Some jurisdictions apply different rules by legal form.", "$ref": "#/components/schemas/LegalForm" }, "street": { "type": [ "null", "string" ], "description": "Street and number. Published in the Peppol Directory if you list the End User there." }, "city": { "type": [ "null", "string" ] }, "postCode": { "type": [ "null", "string" ] } } }, "CreateWebhookRequest": { "required": [ "url" ], "type": "object", "properties": { "url": { "type": "string" } } }, "DirectoryListingRequest": { "required": [ "optIn" ], "type": "object", "properties": { "optIn": { "type": "boolean", "description": "True to list the End User in the Peppol Directory, false to remove the listing." } } }, "IdentifierSchemeSummary": { "required": [ "icd", "schemeId", "name", "example" ], "type": "object", "properties": { "icd": { "type": "string" }, "schemeId": { "type": "string" }, "name": { "type": "string" }, "example": { "type": "string" } } }, "JurisdictionSummary": { "required": [ "countryCode", "name", "peppolAuthority", "identifierSchemes", "defaultDocumentTypes", "mandatoryDocumentTypes", "centralisedSmp", "deregistrationWorkingDays", "supportedCapabilities" ], "type": "object", "properties": { "countryCode": { "type": "string" }, "name": { "type": "string" }, "peppolAuthority": { "oneOf": [ { "type": "null" }, { "$ref": "#/components/schemas/PeppolAuthoritySummary" } ] }, "identifierSchemes": { "type": "array", "items": { "$ref": "#/components/schemas/IdentifierSchemeSummary" } }, "defaultDocumentTypes": { "type": "array", "items": { "type": "string" } }, "mandatoryDocumentTypes": { "type": "array", "items": { "type": "string" } }, "centralisedSmp": { "type": "boolean" }, "deregistrationWorkingDays": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "null", "integer", "string" ], "format": "int32" }, "supportedCapabilities": { "type": "array", "items": { "$ref": "#/components/schemas/CapabilitySummary" } } } }, "LegalForm": { "enum": [ "Company", "SelfEmployed", "PublicBody" ], "default": "Company" }, "PeppolAuthoritySummary": { "required": [ "name", "pasrVersion", "pasrApproved", "pasrUrl" ], "type": "object", "properties": { "name": { "type": "string" }, "pasrVersion": { "type": "string" }, "pasrApproved": { "type": "string", "format": "date" }, "pasrUrl": { "type": "string" } } }, "ProblemDetails": { "type": "object", "properties": { "type": { "type": [ "null", "string" ] }, "title": { "type": [ "null", "string" ] }, "status": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "null", "integer", "string" ], "format": "int32" }, "detail": { "type": [ "null", "string" ] }, "instance": { "type": [ "null", "string" ] } } }, "RegisterParticipantRequest": { "required": [ "endUserId", "participantId", "ownershipConfirmed" ], "type": "object", "properties": { "endUserId": { "type": "string", "format": "uuid" }, "participantId": { "type": "string" }, "ownershipConfirmed": { "type": "boolean", "description": "Must be true. By setting it, the partner confirms that it has verified the End User is the rightful holder of the participant ID, and accepts responsibility for that verification. Redque does not verify ownership; it records this confirmation." }, "capabilities": { "type": [ "null", "array" ], "items": { "$ref": "#/components/schemas/CapabilityRequest" } }, "directoryOptIn": { "type": "boolean", "default": false } } }, "RequestKeyRotationRequest": { "required": [ "partnerId", "slot" ], "type": "object", "properties": { "partnerId": { "type": "string", "format": "uuid" }, "slot": { "pattern": "^-?(?:0|[1-9]\\d*)$", "type": [ "integer", "string" ], "format": "int32" } } }, "SetCapabilitiesRequest": { "required": [ "capabilities" ], "type": "object", "properties": { "capabilities": { "type": "array", "items": { "$ref": "#/components/schemas/CapabilityRequest" } } } }, "UpdateEndUserRequest": { "required": [ "name", "externalRef", "street", "city", "postCode" ], "type": "object", "properties": { "name": { "type": "string" }, "externalRef": { "type": [ "null", "string" ] }, "street": { "type": [ "null", "string" ] }, "city": { "type": [ "null", "string" ] }, "postCode": { "type": [ "null", "string" ] } } } }, "securitySchemes": { "ApiKey": { "type": "apiKey", "description": "Redque-issued partner API key (rqp__…, e.g. rqp_test_…); each environment accepts only its own keys. Each partner has two key slots; rotate one at a time with /v1/api-key-rotations. This key authenticates this API only: your End Users exchange documents with their own keys (rqe_…), which you issue at /v1/end-users/{endUserId}/api-keys.", "name": "X-Api-Key", "in": "header" } } }, "security": [ { "ApiKey": [ ] } ], "tags": [ { "name": "API keys" }, { "name": "Jurisdictions" }, { "name": "End Users" }, { "name": "Participants" }, { "name": "Webhooks" }, { "name": "End User API keys" } ] }