AutoElevate Partner(Beta) n8n Node

The Partner API enables integration partners to programmatically accessAutoElevate data for their managed customers — usage metrics, computerinventory, security events, and more.## BetaThis API is in beta and may change without notice. Every requestmust include an explicit acknowledgment header:X-Acknowledgment: i-understand-this-is-beta-and-may-changeRequests missing this header — or sending any other value — arerejected with 400 Bad Request.## VersioningEvery endpoint is versioned in its URL path — /api/v1/computers,/api/v2/computers, and so on. Pin your integration to an explicitversion.The unversioned path (/api/computers) is a permanent alias forv1 — never the latest version — so publishing a new version cannever silently change the behavior of an existing integration. Newversions are strictly opt-in: adopt one by changing the version segmentin the URL.When a version is deprecated its responses carry a Deprecation: trueheader and, once a removal date is committed, an RFC 8594 Sunsetheader with that date; a Link header with rel="successor-version"points at the replacement. A version is only removed after a publisheddeprecation window — watch for these headers to migrate ahead of time.## Getting Started### 1. Create an API KeyIn the AutoElevate admin portal, open a service user and add anAPI Key. Pick a scheme at creation time:- API Token (AE-BEARER) — recommended for most integrations. Works with any HTTP client, iPaaS platform, SDK generator, or LLM tool.- HMAC (AE-HMAC-SHA256) — request-signed scheme. Signs scheme + METHOD + URL + bodyHash + ts, so both the request target and the body are tamper-protected, bounded by a 5-minute replay window (see below for the exact signing steps).Bearer keys show a single secret at creation. HMAC keys show twovalues — a wire token and a separate hmacKey signing key —both displayed once and never retrievable again.### 2. AuthenticateBearer (AE-BEARER) — send the token directly:bashcurl https://partner-api.autoelevate.com/api/usage \ -H "Authorization: Bearer aeb_xxxxxxxxxxxxxxxxxxxxxxxx" \ -H "X-Acknowledgment: i-understand-this-is-beta-and-may-change"HMAC (AE-HMAC-SHA256) — request-signed scheme. Build theAuthorization header yourself:1. Compute bodyHash — the SHA-256 hex digest of the exact request body bytes. For a request with no body (GET, or a write with an empty body), use the SHA-256 of the empty string: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 — safe to hardcode rather than recompute every time.2. Build the string to sign, joining the parts below with a real newline character (not the literal characters \n): AE-HMAC-SHA256 <METHOD> <URL> <bodyHash> <ts> <METHOD> is uppercase (GET, POST, ...); <URL> is the full request target including any query string; <ts> is the current time as epoch milliseconds.3. Compute sig — HMAC-SHA256 of that string using hmacKey as the key, hex-encoded.4. Send the header:bashcurl https://partner-api.autoelevate.com/api/usage \ -H "Authorization: AE-HMAC-SHA256 token=aeh_xxx,bodyHash=<hex>,ts=<epochMs>,sig=<hex>" \ -H "X-Acknowledgment: i-understand-this-is-beta-and-may-change"````ts` must be within 5 minutes of server time or the request isrejected.### 3. Keep Your Keys Safe- **Prefer short-lived keys.** Expiration presets go down to 15 minutes — for ad-hoc testing, shared machines, or any less-trusted environment, create a short-lived key instead of reusing a long-lived one.- **Scope to least privilege.** Grant only the permissions the integration actually needs; avoid Full access keys for anything long-lived.- **Store keys in a secrets manager** — never in source control, tickets, chat, or shared documents. If a key is ever exposed, revoke it immediately in the admin portal and create a new one.- **Rotate on personnel or role changes.** Keys are tied to the service user they were created under; revoke keys that are no longer needed.## Rate LimitsLimits are applied **per MSP, per HTTP method, per route path** —each unique combination has its own bucket. Defaults during beta:| Bucket | Limit ||--------|-------|| Most endpoints | 100 requests per hour || `/api/usage` | 100 requests per hour |There is no separate per-minute burst layer today; the bucketcounter is a single sliding window. When rate-limited, the APIreturns **429 Too Many Requests** with a `Retry-After` header.Defaults are conservative for beta and may rise as the surfacestabilises.## Client LibrariesGenerate a client from the OpenAPI spec:bashnpx @openapitools/openapi-generator-cli generate \ -i partners-openapi-spec.json \ -g typescript-fetch -o ./partners-client-ts```

Table of Contents

• Installation
• Authentication
• Resources & Operations
• Compatibility
• License

Installation

Follow the n8n community node installation guide.

Or install directly via npm:

npm install @avantguardllc/n8n-nodes-autoelevate

Authentication

This node authenticates using an API Key.

Tip: The Base URL can be changed in the credential settings if your instance uses a different host.

Resources & Operations

Base URL: https://partner-api.autoelevate.com

AuditLogs

Companies

Computers

ElevatedSessions

ElevationEvents

ElevationRequests

ElevationRules

Locations

Usage

Compatibility

• n8n version: 1.0+ (tested on 2.x)
• Node.js version: 18+

License

MIT