The key is shown once. The server keeps only its SHA-256 digest and the first characters (prefix) so you can recognise it.
Every request carries X-Aybarion-Signature: t=<unix seconds>,v1=<hex>. The value is HMAC-SHA256 with your signing secret over <t>.<raw request body>. Reject requests older than 5 minutes and compare in constant time. Other headers: X-Aybarion-Event, X-Aybarion-Delivery (unique id, use it to ignore duplicates), X-Aybarion-Webhook.
Payload: { "id", "type", "created", "member", "data" }. Answer with any 2xx status within 10 seconds; redirects are not followed.
- Base URL
- Authentication
- Authorization: Bearer ayb_live_…
- Methods
- GET (read, CORS enabled) · POST for escrow partner actions (server-to-server)
- Envelope
- { data, meta }
- Errors
- { error: { status, code, message, request_id } }
- Pagination
- page, per_page → meta.pagination.next
- Record ids
- DS-045409:REP:PARTNER:HS:FLOW:PERIOD
Each key has a per-minute rate limit set by your plan; the number of API calls per day is a company-wide allowance of your plan. Responses carry X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset and X-Quota-Remaining; a 429 response includes Retry-After.
Built in
Interfaces that AYBARION operates itself.
Works with your tools
No vendor-specific connector is installed, these tools use the generic interfaces above.
Product names are trademarks of their owners and do not imply endorsement or affiliation. Connections to CRM or ERP systems need your own integration (webhook receiver or API client).