Skip to main content
Every request to /api/v0/** carries two headers.
Keep your secret server-side. Never ship it in browser or mobile code, and never commit it to source control. If it leaks, ask Endl to issue a replacement credential.

​
Permissions

Each key carries permissions that gate which endpoints it can reach — quotes, recipients, accounts, webhooks, and events among them. A valid key that lacks the required permission is rejected with 400 VALIDATION_ERROR, not 403. If a well-formed call fails validation for no apparent reason, check the key’s permissions before you check the body.

​
Failure modes

​
Your credentials were rejected
A header is missing or blank, the key is unknown, the secret is wrong, or the partner is inactive. These are indistinguishable by design. Retrying will not help — fix the configuration.
​
Endl could not verify right now
Endl could not reach the credential store. Your key may be perfectly valid, so retry with backoff. This is deliberately not a 401.
Webhook endpoints use these same two headers. See webhooks authentication for the webhooks and events permissions specifically.