Developer platform
Integrate EcoAttest with your own systems.
A REST API and outbound webhooks, with the same permission model as the interface — so an integration cannot do anything the person who created it could not.
API keys
Scoped, auditable, revocable
An API key is a principal like any other. It carries permissions, and everything it does is recorded against it.
- Issue keys scoped to specific permissions
- A key can never exceed the rights of whoever issued it
- List every active key and what it can reach
- Revoke a key immediately, without rotating anything else
- Key usage is audited like any other actor
Never more than its issuer
A key’s scopes must be a subset of the permissions of whoever created it. A user cannot mint a key more powerful than themselves — a common way integrations quietly become privilege escalation.
Webhooks
Events pushed to you
Rather than polling for changes, subscribe to the events that matter and react when they happen.
Subscribe to domain events
Register an endpoint for the events you care about — evidence uploaded, a visit approved or rejected, and more.
HMAC-signed payloads
Every delivery is signed with your endpoint's secret, so your receiver can verify a request genuinely came from us before acting on it.
Delivery records
Each attempt is recorded with its outcome, so a failing integration is visible rather than silently dropping events.
Idempotent by design
Events carry an identifier, so a retry after a timeout does not cause your system to process the same thing twice.
Scoped to your organisation
Your endpoints receive your organisation's events only. There is no cross-organisation delivery path.
Revocable
Disable an endpoint immediately if it is compromised or simply noisy, without touching your API keys.
Documentation
The API is specified, not described
The platform publishes an OpenAPI specification, which is the contract the product's own interface is generated from — so it cannot drift from what the API actually does.
- OpenAPI 3.1 specification
- Uniform error envelope across every endpoint
- Cursor pagination with whitelisted filter and sort fields
- ISO-8601 UTC timestamps, UUID identifiers, money in minor units
- Rate limit headers and standard status codes
Public developer documentation is not yet published on this site. API access is available today — ask us and we will share the specification and get you set up directly.
Tell us what you want to build.
We'll share the specification and talk through how it fits your systems.