API key
Use an org-scoped bearer token for mapping progression, deployment-bundle issuance, protocol artifact submission, and org-scoped artifact retrieval.
Loading…
API documentation
Authentication
Decionis separates public docs and share-safe verification routes from org-scoped write and read routes. Production integrations should assume API-key auth plus webhook secret validation unless a route is explicitly documented as public or pilot-scoped.
Auth model
Decionis keeps trust boundaries explicit. Integrations should not infer public access for any route that mutates state or reveals governed artifacts.
Public access
Use only for published docs, marketplace entry pages, and share-safe dossier verification routes.
Webhook secret
Treat Decionis-issued connector secrets as write-path credentials for inbound provider traffic.
Headers
These are the default request headers for authenticated calls.
Authorization: Bearer sk_org_xxx
Content-Type: application/json
Accept: application/jsonPOST
/v1/public/pilot/signal-mapping/sessions/:sessionId/deployment-bundlePilot accessRepresentative authenticated request shape for issuing runtime credentials from the zero-config onboarding flow.
curl -X POST https://api.decionis.com/v1/public/pilot/signal-mapping/sessions/<session_id>/deployment-bundle \
-H "Authorization: Bearer sk_org_xxx" \
-H "Content-Type: application/json" \
-d '{"provider_key":"enilo_ai","workflow_key":"eligibility_assessment","source_label":"enilo_primary"}'Route boundaries
Integrators should model Decionis around route trust classes rather than product packaging.
| Route class | Examples | Auth posture |
|---|---|---|
| Org-scoped write and read | /v1/protocol/policies/bundles, /v1/protocol/dossiers/:id | Bearer API key |
| Connector webhook ingress | /v1/signals/webhooks/:connectorId | Webhook secret or signature header |
| Public verification | /v1/public/decision-dossiers/:dossierId/verify | Public with verification token in query |
| Pilot bootstrap | /v1/public/pilot/signal-mapping/sessions, /v1/public/pilot/signal-mapping/sessions/:sessionId/deployment-bundle | Onboarding grant or org-scoped API key |
Webhook trust
Webhook verification is part of the API contract because production signal ingress is webhook-based today.
curl -X POST https://api.decionis.com/v1/signals/webhooks/<connector_id> \
-H "Content-Type: application/json" \
-H "x-webhook-secret: whsec_xxx" \
-d '{"events":[{"type":"eligibility_assessed","timestamp":"2026-03-11T10:30:00Z","data":{"case_id":"case_123"}}]}'