Skip to main content

Partner Portal APIs

Portal endpoints for authenticated partner users.

Base URL​

https://service-gateway.loscenotes.com/api/partner-portal

Authentication​

Authorization: Bearer <jwt>

Endpoint groups​

Dashboard​

Metrics (ingestion + portal UI)

GET /api/partner-portal/metrics returns API timeseries from partner_api_logs (apiCalls, responseTime, errorRate, topEndpoints, statusCodes). Public Partner API traffic is ingested via PartnerAuditInterceptor when partnerContext.partnerId is present. The portal dashboard renders an API metrics section for that contract; empty logs → honest empty charts (no fake zeros). Primary business KPIs still come from the hybrid dashboard (GET /dashboard), not this timeseries.

  • GET /api/partner-portal/dashboard
  • GET /api/partner-portal/metrics
  • GET /api/partner-portal/activity-feed

API key management​

  • GET /api/partner-portal/api-keys — returns masked key + keyPrefix + lastUsedAt (no full secret)
  • POST /api/partner-portal/api-keys — once-reveal full key on create
  • PUT /api/partner-portal/api-keys/:keyId
  • DELETE /api/partner-portal/api-keys/:keyId
  • POST /api/partner-portal/api-keys/:keyId/rotate — once-reveal on rotate

Webhooks​

Public HTTPS only

Portal webhook create/update/test reject private/metadata URLs. Outbound delivery uses maxRedirects: 0 and pinned DNS (anti rebinding).

  • GET /api/partner-portal/webhooks
  • POST /api/partner-portal/webhooks
  • PUT /api/partner-portal/webhooks/:webhookId
  • DELETE /api/partner-portal/webhooks/:webhookId
  • POST /api/partner-portal/webhooks/:webhookId/test
  • GET /api/partner-portal/webhooks/:webhookId/logs

Onboarding​

  • POST /api/partner-portal/onboarding/start
  • GET /api/partner-portal/onboarding/status
  • POST /api/partner-portal/onboarding/complete-step/:step

Portal sandbox​

  • GET /api/partner-portal/sandbox/status
  • POST /api/partner-portal/sandbox/reset
  • POST /api/partner-portal/sandbox/generate-data

Live when schema partners_sandbox exists: generate/reset/status return real sandbox operations. Soft-fail (success payload explaining unavailability) only if the schema is missing on that environment. Minted sk_test_ keys are for sandbox tooling only — they cannot call /api/partner/* production routes.

Billing and usage​

Billing P2 (partial)

API call counts may be real; bandwidth, webhook usage metrics, plan catalog, and settlements-as-invoices remain incomplete. Portal billing UI is live (/partner/billing) for usage / invoices / plan — still not a full commercial billing product.

  • GET /api/partner-portal/billing/usage
  • GET /api/partner-portal/billing/invoices
  • GET /api/partner-portal/billing/plan

Support​

Support tickets live (partner-scoped); admin triage deferred

Create/list persist to partner_support_tickets (migration v23.0.67), scoped to the authenticated partner. Portal UI: /partner/support. Staff Admin triage UI is not shipped yet — partners can still create and list their own tickets.

  • POST /api/partner-portal/support/ticket
  • GET /api/partner-portal/support/tickets
  • GET /api/partner-portal/quickstart

Notes​

  • these endpoints are operational/portal-focused, not public partner API key endpoints
  • data isolation is enforced through the authenticated partner context
  • for organization-level config, users, reports, reservations and sandbox tooling, see Management features