> ## Documentation Index
> Fetch the complete documentation index at: https://docs.amlok.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication and authorization

> Use workspace-scoped bearer keys and explicit resource permissions.

## Bearer API keys

Financial-data and reporting operations use server-to-server API keys bound to exactly one workspace, institution tenant, and environment. [Healthcheck](https://docs.amlok.io/api-reference/endpoints/platform/healthcheck.md) and [service status](https://docs.amlok.io/api-reference/endpoints/platform/service-status.md) are public read-only exceptions and require no API key.

```http theme={null}
Authorization: Bearer <AMLOK_API_KEY>
Accept: application/json
```

Use HTTPS. Keep credentials in your secret manager and load them on the server. Never put keys in a query string, browser bundle, analytics event, error report, or shared Postman export.

Your account manager provides client portal access information and environment details. Authorized administrators create API keys in the client portal, choosing the workspace, environment and permitted scopes. Manage expiry, revocation and rotation there. Authenticate server-side requests with your portal-created API key.

## Authorization has several layers

| Check | What it controls |
| - | - |
| Environment | A sandbox credential must not authorize production data. |
| Institution and workspace | Every resource and linked ID must belong to the one workspace bound to the key. |
| Endpoint scope | The operation requires its documented scope. |
| Product and provider entitlement | The institution must be entitled to the requested product and source. |
| Subject consent and purpose | Data collection and use must remain within recorded authorization. |
| Field entitlement | Sensitive fields can require additional permissions and purpose checks. |

Caller-supplied `tenant_id` or `workspace_id` values cannot select another workspace. The API derives the workspace and institution from the key. Every subject, document, manifest, baseline, and webhook destination must belong to that workspace. Use a separately provisioned key for another workspace.

Read access does not authorize borrower communications, funding, filings, or changes to credit limits. AMLOK provides assessment results and risk alerts to your institution. Borrower outreach, collections, and intervention remain in your institution's own systems. Credit access is reporting-only. No customer wallet or payment-setting endpoints are exposed. The client portal manages payment methods, top-up settings, and cancellation. Enterprise clients can also request cancellation through their dedicated account manager. Cancellation is available at any time without notice, with an immediate stop to processing, usage deductions, and upcoming top-ups. Full closure is at the end of the request month with an immediate refund of all unused credits to the saved portal bank account. Deletion follows month closure and generation of final information. Report generation and downloads do not change credits.

## Scope reference

Scopes are API permissions. They are not OAuth claims or evidence that a provider grants all requested data.

| Scope | Operations | Example |
| - | -: | - |
| `accounting:read` | 20 | [List ledger accounts](https://docs.amlok.io/api-reference/endpoints/accounting/list-ledger-accounts.md) |
| `audit:read` | 2 | [List audit events](https://docs.amlok.io/api-reference/endpoints/operations/list-audit-events.md) |
| `banking:read` | 10 | [List bank accounts](https://docs.amlok.io/api-reference/endpoints/banking/list-bank-accounts.md) |
| `billing:export` | 4 | [Create billing report](https://docs.amlok.io/api-reference/endpoints/billing/create-billing-report.md) |
| `billing:read` | 18 | [Retrieve current billing snapshot](https://docs.amlok.io/api-reference/endpoints/billing/retrieve-current-billing-snapshot.md) |
| `commerce:read` | 8 | [List counterparties](https://docs.amlok.io/api-reference/endpoints/commerce/list-counterparties.md) |
| `connections:read` | 5 | [List connections](https://docs.amlok.io/api-reference/endpoints/platform/list-connections.md) |
| `connections:write` | 4 | [Create connection](https://docs.amlok.io/api-reference/endpoints/platform/create-connection.md) |
| `consent:read` | 2 | [List consents](https://docs.amlok.io/api-reference/endpoints/platform/list-consents.md) |
| `consent:write` | 2 | [Create consent](https://docs.amlok.io/api-reference/endpoints/platform/create-consent.md) |
| `documents:read` | 3 | [List documents](https://docs.amlok.io/api-reference/endpoints/identity/list-documents.md) |
| `documents:write` | 1 | [Upload document](https://docs.amlok.io/api-reference/endpoints/identity/upload-document.md) |
| `identity:read` | 14 | [List businesses](https://docs.amlok.io/api-reference/endpoints/identity/list-businesses.md) |
| `identity:verify` | 1 | [Start verification](https://docs.amlok.io/api-reference/endpoints/identity/start-verification.md) |
| `identity:write` | 3 | [Create business](https://docs.amlok.io/api-reference/endpoints/identity/create-business.md) |
| `inventory:read` | 16 | [List products](https://docs.amlok.io/api-reference/endpoints/inventory/list-products.md) |
| `lending:read` | 18 | [List applications](https://docs.amlok.io/api-reference/endpoints/lending/list-applications.md) |
| `lending:write` | 1 | [Create application](https://docs.amlok.io/api-reference/endpoints/lending/create-application.md) |
| `liens:read` | 6 | [List lien searches](https://docs.amlok.io/api-reference/endpoints/liens/list-lien-searches.md) |
| `liens:search` | 1 | [Start lien search](https://docs.amlok.io/api-reference/endpoints/liens/start-lien-search.md) |
| `monitoring:read` | 6 | [List monitors](https://docs.amlok.io/api-reference/endpoints/risk/list-monitors.md) |
| `monitoring:write` | 2 | [Create monitor](https://docs.amlok.io/api-reference/endpoints/risk/create-monitor.md) |
| `operations:read` | 2 | [List requirements](https://docs.amlok.io/api-reference/endpoints/operations/list-requirements.md) |
| `payments:read` | 12 | [List merchant accounts](https://docs.amlok.io/api-reference/endpoints/payments/list-merchant-accounts.md) |
| `platform:read` | 7 | [List reconciliation links](https://docs.amlok.io/api-reference/endpoints/platform/list-reconciliation-links.md) |
| `risk:calculate` | 1 | [Calculate attributes](https://docs.amlok.io/api-reference/endpoints/risk/calculate-attributes.md) |
| `risk:read` | 11 | [List attributes](https://docs.amlok.io/api-reference/endpoints/risk/list-attributes.md) |
| `webhooks:read` | 4 | [List webhook endpoints](https://docs.amlok.io/api-reference/endpoints/webhooks/list-webhook-endpoints.md) |
| `webhooks:write` | 2 | [Create webhook endpoint](https://docs.amlok.io/api-reference/endpoints/webhooks/create-webhook-endpoint.md) |
| `workflows:execute` | 2 | [Start workflow run](https://docs.amlok.io/api-reference/endpoints/operations/start-workflow-run.md) |
| `workflows:read` | 2 | [List workflow runs](https://docs.amlok.io/api-reference/endpoints/operations/list-workflow-runs.md) |

## Authentication failures

* **401 `unauthenticated`:** missing, invalid, expired, or incorrect-environment credential. Stop retrying until credentials are corrected.
* **403 `forbidden`:** the key is authenticated but lacks the necessary scope or entitlement.
* **404 `not_found`:** an ID is missing or not visible to this institution. Do not probe IDs from other tenants.

## Credential rotation

When your environment supports overlapping keys, provision a replacement, update consumers, verify traffic uses it, and revoke the old key through the agreed administration process. If overlap is unavailable, coordinate a cutover. Never infer a rotation endpoint from this guide.

Webhook signing secrets are separate from API keys. Store each secret with its destination and environment. The registration response returns a new signing secret only once; list responses omit it.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.