Developer documentation · API v1

A predictable, private API for claims workflows.

Enterprise customers can read authorised project and event records from trusted server-side integrations. Keys are company-scoped, hash-only, revocable and rate limited.

Overview

Base URL: https://api.contractingclaims.com/v1. The current stable version is v1. Responses use JSON and include a request ID where relevant.

Authentication

Create a named key in the API dashboard. The full secret is displayed once. Send it in the x-api-key header from secure server-side code.

curl https://api.contractingclaims.com/v1/public/projects \
  -H "x-api-key: cc_live_YOUR_KEY"

Endpoints

GET/public/projects

List up to 100 projects for the key's company.

GET/public/projects/{projectId}/events

List up to 100 authorised events for a project.

Errors

Errors return a relevant HTTP status and a safe JSON message: {"error":"A valid x-api-key header is required"}.

401 Missing, invalid, expired, revoked or inactive key.

402 Plan does not include API access.

403 Permission denied.

429 Rate limit exceeded.

500 Unexpected server error; quote the request ID to support.

Rate limits and billing

Enterprise API keys are limited to 120 requests per minute per key. Higher-volume, webhook and write-access requirements are reviewed as part of Enterprise onboarding.

JavaScript example

const response = await fetch(
  "https://api.contractingclaims.com/v1/public/projects",
  { headers: { "x-api-key": process.env.CONTRACTINGCLAIMS_API_KEY } }
);
const { data, requestId } = await response.json();

Security notes

Never expose API keys in browser code, mobile apps, public repositories, logs or support messages. Use a secrets manager, create separate keys per integration, review last-used timestamps and revoke unused keys promptly. API keys cannot access another company.