> ## Documentation Index
> Fetch the complete documentation index at: https://docs.amlok.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Downloads and developer tools

> Use the machine-readable contract and runnable verification examples.

> **[OpenAPI 3.1 contract](https://docs.amlok.io/openapi/amlok-v1.json)**
>
> 192 operations, resource schemas, authentication, examples, and the webhook envelope.

> **[Postman collection](https://docs.amlok.io/downloads/amlok-api.postman_collection.json)**
>
> Requests grouped by domain with synthetic saved responses.

> **[Node.js webhook verifier](https://raw.githubusercontent.com/amloktech/docs/main/downloads/verify-webhook.mjs)**
>
> Verify raw-body HMAC signatures using built-in Node.js crypto.

> **[Python webhook verifier](https://raw.githubusercontent.com/amloktech/docs/main/downloads/verify_webhook.py)**
>
> Verify the same signature format using the Python standard library.

The webhook helpers link to the maintained source files for this reference. Save the Node.js helper as `verify-webhook.mjs` and the Python helper as `verify_webhook.py`.

## Import the Postman collection

1. Import the downloaded JSON file.
2. Set `base_url` to your institution-issued environment URL. The exported `base_url` value is empty so you can configure the appropriate environment.
3. Store `api_key` locally in a protected environment or vault. The exported collection contains no credential.
4. Set `idempotency_key` once for one intended POST action. Use a new value for a new action and preserve it for retries of the same action.
5. Replace synthetic resource IDs and configure the current `record_etag` before a PATCH.
6. Select a local file before trying the multipart upload request.

Saved responses are examples, not captured production traffic. Do not run every POST as a bulk collection against production: some routes initiate processing or change a monitoring configuration.

## Language examples

Endpoint pages provide cURL, Python with `requests`, and Node.js using `fetch`. The examples use a 30-second client timeout and reject unexpected redirects. They are integration examples, not official AMLOK SDK packages.

The webhook helpers have no third-party runtime dependency. They verify signatures and envelope basics only; add durable inbox processing, tenant association, replay handling, and operational monitoring as described in the [webhook guide](https://docs.amlok.io/api-reference/webhooks.md).

## Contract validation

The reference has been checked for OpenAPI structure and generated request/response example validity against JSON Schema. Language samples have been syntax-checked, and both signature helpers have been tested using synthetic signed events, altered bodies, expired/future timestamps, and malformed headers.

Validate your integration with your enabled providers, environment settings, and representative test data before processing live requests.

## Complete product journeys

Use the [sandbox journeys](https://docs.amlok.io/api-reference/sandbox-journeys.md), [Python runner](https://raw.githubusercontent.com/amloktech/docs/main/downloads/run-sandbox-journey.py), and [Postman journey collection](https://docs.amlok.io/downloads/amlok-journeys.postman_collection.json) to follow returned identifiers through complete Insights and Signal flows.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.