Documentation

Your first authenticated call in under a minute. No SDK required, and every response carries a request_id you can quote to support.

1. Check connectivity, no key needed. Every product publishes a public capability document:

   curl https://abundera.ai/.well-known/abundera-capabilities.json

   You get back JSON describing scopes, auth methods, and rate-limit tiers.
2. Create a scoped key. Open API keys and mint one with only the scopes the integration needs. The raw key is shown once, so copy it then.
3. Make an authenticated request. Pass the key as a bearer token. This endpoint works for every account from the moment the key exists — no billing data needed:

   curl https://abundera.ai/v1/api/compliance-status \
     -H "Authorization: Bearer YOUR_KEY"

   Success returns the requested data plus a request_id. A failure returns a stable error message and the same request_id:

   { "error": "Authentication required.", "request_id": "a096cbe8-LAX" }

The full endpoint catalog (300+ operations across 180+ paths), with request and response schemas plus try-it-now, is in the interactive reference. Import the Postman collection or copy curl examples for every endpoint.

Building with an AI agent? The API is designed to be integrated by a coding agent end to end. Point it at llms.txt for a machine-readable map and the OpenAPI spec for the full contract. Errors return a stable message and code so an agent can branch on the failure instead of parsing prose.

Or skip the HTTP layer entirely. The API ships a native MCP server at https://abundera.ai/mcp (streamable HTTP, no session required). An agent connects once and gets three tools: search_operations to find any of the API's operations, describe_operation for exact parameter and body schemas, and invoke_operation to call them with the key it connected with. With Claude Code:

claude mcp add --transport http abundera https://abundera.ai/mcp \
  --header "Authorization: Bearer YOUR_KEY"

Develop offline against a local mock. The published spec is Prism-compatible, so a full mock of the API runs with one command — no credentials, no rate limits. Simulate any error with a Prefer: code=429 header:

npx @stoplight/prism-cli mock https://abundera.ai/docs/openapi.yaml

Deliveries follow the Standard Webhooks spec: three headers (webhook-id, webhook-timestamp, webhook-signature), signed content {id}.{timestamp}.{rawBody}, HMAC-SHA256 with your endpoint's whsec_ secret, signature formatted v1,<base64>. Reject anything older than 5 minutes, and dedupe on webhook-id — it is the canonical idempotency key for your consumer.

Node:

const crypto = require("node:crypto");
function verify(secret, headers, rawBody) {
  const id = headers["webhook-id"], ts = headers["webhook-timestamp"];
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;
  const key = Buffer.from(secret.slice("whsec_".length), "base64");
  const expected = crypto.createHmac("sha256", key)
    .update(`${id}.${ts}.${rawBody}`).digest("base64");
  return headers["webhook-signature"].split(" ").some((sig) => {
    const [v, b64] = sig.split(",");
    return v === "v1" && b64.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(b64), Buffer.from(expected));
  });
}

Python:

import base64, hashlib, hmac, time
def verify(secret, headers, raw_body):
    wid, ts = headers["webhook-id"], headers["webhook-timestamp"]
    if abs(time.time() - int(ts)) > 300:
        return False
    key = base64.b64decode(secret.removeprefix("whsec_"))
    expected = base64.b64encode(hmac.new(
        key, f"{wid}.{ts}.".encode() + raw_body, hashlib.sha256).digest()).decode()
    return any(s.split(",", 1) == ["v1", expected]
               or hmac.compare_digest(s.split(",", 1)[1], expected)
               for s in headers["webhook-signature"].split(" ")
               if s.startswith("v1,"))

Test it before going live: trigger a webhook.ping test event to your endpoint from Settings → Webhooks. Rotating a secret is zero-downtime: the signature header carries signatures from both old and new secrets during the rotation window, so verify against whichever you hold and swap at your own pace.

The Abundera API follows OpenAPI 3.0.3. Browse the interactive reference, download the full specification, or import it into your preferred API client.

A comprehensive overview of Abundera's security architecture, authentication design, data encryption, and compliance posture. Written for security teams, compliance officers, and technical evaluators.

Covers passkey-only authentication, database isolation by tier, automated security auditing ( checks), continuous penetration testing (908 simulations), 16,593 unit tests, and alignment with 10 regulatory frameworks.

Legal and compliance documents governing how Abundera handles your data.

Auto-discovery endpoints under /.well-known/ (RFC 8615). Browse the human-readable index, or fetch directly: