Authentication

Every request to /api/v0/** carries two headers.

Header	Value
`X-API-KEY`	Your partner API key, which identifies the credential.
`X-API-SECRET`	Your partner API secret, compared in constant time.

curl https://qa-api.endl.xyz/api/v0/webhooks/subscriptions \
  -H "X-API-KEY: $ENDL_API_KEY" \
  -H "X-API-SECRET: $ENDL_API_SECRET"

Keep your secret server-side. Never ship it in browser or mobile code, and never commit it to source control.

Permissions

Each key carries permissions that gate which endpoints it can reach.

Permission	Grants access to
`webhooks`	Manage subscriptions and inspect deliveries.
`events`	Read the PULL event feed.

A valid key that lacks the required permission is rejected with 400 VALIDATION_ERROR — not 403.

Authentication fails closed, and deliberately does not tell you which part was wrong.

Your credentials were rejected

A header is missing or blank, the key is unknown, the secret is wrong, or the partner is inactive. All four are indistinguishable by design.

Endl could not verify right now

Endl could not reach the credential store. Your key may be perfectly valid, so retry with backoff. This is deliberately not a 401.

Treat 401 as a configuration problem to fix and 503 as a transient fault to retry. Retrying a 401 will never succeed.