CARM API

Integration documentation

Use the versioned REST API to submit catalogues, run ratings, value assets, and verify certificates.

Browse API referenceDownload spec

Quick start

curl -X POST /v1/ratings \
  -H "Authorization: Bearer sk_sandbox_..." \
  -H "Idempotency-Key: your-unique-operation-id" \
  -H "Content-Type: application/json" \
  -d '{"catalogue_id":"..."}'
Environment and capability status
Use sandbox credentials during integration. Production key issuance, outbound webhooks, and production certificate signing require separately approved deployment controls; examples here do not imply those services are active.

Authentication and safety

  • Send bearer API keys only from a protected server.
  • Keys are workspace-scoped, environment-specific, revocable, and never shown again.
  • Use an idempotency key for retryable writes and never log credentials or raw evidence.

Resource lifecycle

  1. 1. Upsert a workspace-owned catalogue.
  2. 2. Create an immutable rating snapshot.
  3. 3. Value that exact rating identifier.
  4. 4. Request human-reviewed certificate processing.

Errors and versioning

Treat 4xx responses as request or authorization failures and 5xx responses as safely retryable only when the operation supports idempotency. The /v1 path versions the public contract; methodology versions remain independently recorded on results.

Rate limits and webhooks

Respect Retry-After when returned. Sandbox webhook records use HMAC-SHA256, timestamps, delivery IDs, replay-resistant signatures, bounded retry state, and audited manual replay. Outbound delivery requires the approved server-side encryption key; live delivery remains gated.

Catalogue

Upsert a partner-owned catalogue object.

Rating

Receive the CARM score and M/L/T breakdown.

Certificate

Request a human-reviewed, verifiable certificate.

OpenAPI document: /v1/openapi.json