Skip to main content

​
Base URL

Set AMLOK_API_BASE_URL to the HTTPS origin issued for your institution and environment. Use the matching environment-specific API key. Sandbox and production keys, subjects, provider connections, consent records, event destinations, and idempotency records must remain separate. Do not copy production evidence into a sandbox unless your approved data-handling process explicitly allows it.

​
Request format

Paths begin /v1. JSON writes use Content-Type: application/json. JSON reads use Accept: application/json. Document uploads use multipart form data with a client-generated boundary. Treat IDs as opaque case-sensitive strings. Do not trim leading zeros, infer information from a prefix, or reuse an ID across environments.

​
Network behavior

The examples use a 30-second client timeout as an illustration, not a server SLA. Set explicit timeouts suited to your application. A timeout does not prove a command was rejected; retain its idempotency key when retrying. Do not forward an API credential to a redirected host. Configure the correct origin and reject unexpected redirects. Long-running work returns a resource to poll instead of holding the HTTP connection open.

​
Environment configuration

Onboarding must provide the production and sandbox origins, enabled scopes and providers, numeric quotas, network controls, support route, incident contacts, and any contractual service commitments. See integration onboarding.