A REST API for inspections, suppliers, shipments, and dashboard data - the same endpoints the Dashboard is built on.
The same API the Dashboard itself is built on.
Every authenticated data endpoint requires an API key sent in the X-API-Key header.
Create, retrieve, and list inspections - quality, risk, and shelf-life analytics are included in the response metadata.
The same KPIs, trends, and recommendations that power the Executive Dashboard, as JSON.
Supplier, market, and claims intelligence endpoints - defined in the API, but not enabled in the current single-customer deployment.
A typical request cycle, start to finish.
Send your API key in the X-API-Key header when calling authenticated endpoints.
POST a new inspection record with quality and compliance data.
GET the resulting quality, risk, and shelf-life scores.
Feed the response into your own dashboard or workflow tools.
What's actually true about the API today.
REST
A conventional REST API - resources, HTTP verbs, and predictable JSON responses.
JSON
Application endpoints exchange JSON. Operational endpoints such as /metrics follow their native protocol.
Versioning
Newer endpoint groups are versioned under /api/v1. A few earlier groups predate versioning and remain on their original path for now.
Error handling
Errors return a consistent envelope with a stable error code, not just an HTTP status.
Inspections, Suppliers, Dashboard, and System are available in the current single-customer deployment. The intelligence and compliance groups are defined in the API but Supabase-backed, and are not enabled in that deployment yet - each row says so.
| Group | Base path | Description |
|---|---|---|
| Suppliers | /api/v1/suppliers | Full CRUD - list, get, create, update, delete |
| Inspections | /api/v1/inspections | Full CRUD - list, get, create, update, delete |
| Supplier Intelligence | /api/v1/intelligence/supplier | Performance and ranking scores per supplier - Supabase-backed, not enabled in the current deployment |
| Market Intelligence | /api/v1/intelligence/market | Market suitability rankings - Supabase-backed, not enabled in the current deployment |
| Claims Intelligence | /api/v1/intelligence/claims | Claims summary and cost analysis - Supabase-backed, not enabled in the current deployment |
| Risk & Recommendation Scoring | /intelligence | Deterministic shipment scoring, recommendations, aggregated dashboard - Supabase-backed, not enabled in the current deployment |
| Dashboard | /dashboard | KPIs, suppliers, shipments, recommendations, markets, trends, overview |
| Copilot | /copilot/chat | Rule-based question interface, no LLM (Early Access) |
| System | /live, /health, /ready, /metrics | Liveness, health, readiness, and Prometheus metrics |
What's actually implemented - we don't claim certifications we don't hold.
Every authenticated request carries an X-API-Key header, validated against a hashed, expirable key store.
Keys are scoped to roles (Read Only, Quality Manager, Inspector, Admin, ...) - write operations require a role beyond read access.
Per-key and per-IP token-bucket limits protect the API from abuse, with a Retry-After header on 429 responses.
HTTPS enforcement, CORS, and trusted-host allowlisting are configured per deployment - not open to any origin by default.
Send your API key in the X-API-Key header when calling authenticated endpoints. Contact us and we'll issue one.
Generous per-key and per-IP limits by default. Exceeding them returns a 429 with a Retry-After header. Contact us if your integration needs a higher limit.
Not yet - today it's a plain REST API. Tell us what language you're integrating in if a client library would help.
Newer endpoint groups are versioned under /api/v1; a few earlier groups predate versioning and remain on their original path. We'll call out breaking changes before they ship.
Not yet - we don't have a separate sandbox or test environment today. Contact us and we'll help you integrate safely.
Book a walkthrough with our team, or explore the live dashboard yourself.