Skip to main content

OpenAPI 3.1 contract

192 operations, resource schemas, authentication, examples, and the webhook envelope.

Postman collection

Requests grouped by domain with synthetic saved responses.

Node.js webhook verifier

Verify raw-body HMAC signatures using built-in Node.js crypto.

Python webhook verifier

Verify the same signature format using the Python standard library.
The webhook helpers link to the maintained source files for this reference. Save the Node.js helper as verify-webhook.mjs and the Python helper as verify_webhook.py.

​
Import the Postman collection

  1. Import the downloaded JSON file.
  2. Set base_url to your institution-issued environment URL. The exported base_url value is empty so you can configure the appropriate environment.
  3. Store api_key locally in a protected environment or vault. The exported collection contains no credential.
  4. Set idempotency_key once for one intended POST action. Use a new value for a new action and preserve it for retries of the same action.
  5. Replace synthetic resource IDs and configure the current record_etag before a PATCH.
  6. Select a local file before trying the multipart upload request.
Saved responses are examples, not captured production traffic. Do not run every POST as a bulk collection against production: some routes initiate processing or change a monitoring configuration.

​
Language examples

Endpoint pages provide cURL, Python with requests, and Node.js using fetch. The examples use a 30-second client timeout and reject unexpected redirects. They are integration examples, not official AMLOK SDK packages. The webhook helpers have no third-party runtime dependency. They verify signatures and envelope basics only; add durable inbox processing, tenant association, replay handling, and operational monitoring as described in the webhook guide.

​
Contract validation

The reference has been checked for OpenAPI structure and generated request/response example validity against JSON Schema. Language samples have been syntax-checked, and both signature helpers have been tested using synthetic signed events, altered bodies, expired/future timestamps, and malformed headers. Validate your integration with your enabled providers, environment settings, and representative test data before processing live requests.

​
Complete product journeys

Use the sandbox journeys, Python runner, and Postman journey collection to follow returned identifiers through complete Insights and Signal flows.