Documentation

Your first authenticated call in under a minute. No SDK required, and every response carries a request_id you can quote to support.

1. Check connectivity, no key needed. Every product publishes a public capability document:

   curl https://abundera.ai/.well-known/abundera-capabilities.json

   You get back JSON describing scopes, auth methods, and rate-limit tiers.
2. Create a scoped key. Open API keys and mint one with only the scopes the integration needs. The raw key is shown once, so copy it then.
3. Make an authenticated request. Pass the key as a bearer token. This endpoint works for every account from the moment the key exists — no billing data needed:

   curl https://abundera.ai/v1/api/compliance-status \
     -H "Authorization: Bearer YOUR_KEY"

   Success returns the requested data plus a request_id. A failure returns a stable error message and the same request_id:

   { "error": "Authentication required.", "request_id": "a096cbe8-LAX" }

The full endpoint catalog (300+ operations across 180+ paths), with request and response schemas plus try-it-now, is in the interactive reference. Import the Postman collection or copy curl examples for every endpoint.

Building with an AI agent? The API is designed to be integrated by a coding agent end to end. Point it at llms.txt for a machine-readable map and the OpenAPI spec for the full contract. Errors return a stable message and code so an agent can branch on the failure instead of parsing prose.

Use MCP for agent tool calls. The MCP implementation at https://abundera.ai/mcp uses stateless Streamable HTTP and requires protocol 2026-07-28. Deployment and compatibility with individual agent hosts are still under verification. Its tools include task-oriented helpers plus search_operations, describe_operation, and invoke_operation. Search and describe expose the generated operation catalog; operations tagged admin, docs, internal, mcp, or oauth are excluded. Execution requires a bearer API key or a product-scoped OAuth token, and the underlying API enforces its permissions. Review consequential operations before invoking them.

A supporting client uses server/discover, supplies protocol metadata, and sends matching MCP-Protocol-Version and Mcp-Method headers; tool calls also require Mcp-Name. Legacy initialization is rejected. Use the API reference for endpoint contracts.

For a deployment running this protocol, public discovery requires no credential:

curl https://abundera.ai/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -H 'MCP-Protocol-Version: 2026-07-28' \
  -H 'Mcp-Method: server/discover' \
  --data '{"jsonrpc":"2.0","id":1,"method":"server/discover","params":{"_meta":{"io.modelcontextprotocol/protocolVersion":"2026-07-28","io.modelcontextprotocol/clientCapabilities":{}}}}'

Develop offline against a local mock. The published spec is Prism-compatible, so a full mock of the API runs with one command. No credentials, no rate limits. Simulate any error with a Prefer: code=429 header:

npx @stoplight/prism-cli mock https://abundera.ai/docs/openapi.yaml

Deliveries follow the Standard Webhooks spec: three headers (webhook-id, webhook-timestamp, webhook-signature), signed content {id}.{timestamp}.{rawBody}, HMAC-SHA256 with your endpoint's whsec_ secret, signature formatted v1,<base64>. Reject anything older than 5 minutes, and dedupe on webhook-id, the canonical idempotency key for your consumer.

Node:

const crypto = require("node:crypto");
function verify(secret, headers, rawBody) {
  const id = headers["webhook-id"], ts = headers["webhook-timestamp"];
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;
  const key = Buffer.from(secret.slice("whsec_".length), "base64");
  const expected = crypto.createHmac("sha256", key)
    .update(`${id}.${ts}.${rawBody}`).digest("base64");
  return headers["webhook-signature"].split(" ").some((sig) => {
    const [v, b64] = sig.split(",");
    return v === "v1" && b64.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(b64), Buffer.from(expected));
  });
}

Python:

import base64, hashlib, hmac, time
def verify(secret, headers, raw_body):
    wid, ts = headers["webhook-id"], headers["webhook-timestamp"]
    if abs(time.time() - int(ts)) > 300:
        return False
    key = base64.b64decode(secret.removeprefix("whsec_"))
    expected = base64.b64encode(hmac.new(
        key, f"{wid}.{ts}.".encode() + raw_body, hashlib.sha256).digest()).decode()
    return any(s.split(",", 1) == ["v1", expected]
               or hmac.compare_digest(s.split(",", 1)[1], expected)
               for s in headers["webhook-signature"].split(" ")
               if s.startswith("v1,"))

Test it before going live: trigger a webhook.ping test event to your endpoint from Settings → Webhooks. Rotating a secret is zero-downtime: the signature header carries signatures from both old and new secrets during the rotation window, so verify against whichever you hold and swap at your own pace.

The Abundera API follows OpenAPI 3.0.3. Browse the interactive reference, download the full specification, or import it into your preferred API client.

A comprehensive overview of Abundera's security architecture, authentication design, data encryption, and compliance posture. Written for security teams, compliance officers, and technical evaluators.

Covers passkey-only authentication, database isolation by tier, automated security auditing ( checks), continuous penetration testing (1,053 simulations), 20,679 unit tests, and alignment with 10 regulatory frameworks.

Legal and compliance documents governing how Abundera handles your data.

Auto-discovery endpoints under /.well-known/ (RFC 8615). Browse the human-readable index, or fetch directly: