AutoElevate Partner(Beta)Install

The Partner API enables integration partners to programmatically accessAutoElevate data for their managed customers — usage metrics, computerinventory, security events, and more.## BetaThis API is in **beta** and may change without notice. Every requestmust include an explicit acknowledgment header:```X-Acknowledgment: i-understand-this-is-beta-and-may-change```Requests missing this header — or sending any other value — arerejected with **400 Bad Request**.## VersioningEvery endpoint is versioned in its URL path — `/api/v1/computers`,`/api/v2/computers`, and so on. Pin your integration to an explicitversion.The **unversioned** path (`/api/computers`) is a permanent alias for**v1** — never the latest version — so publishing a new version cannever silently change the behavior of an existing integration. Newversions are strictly opt-in: adopt one by changing the version segmentin the URL.When a version is deprecated its responses carry a `Deprecation: true`header and, once a removal date is committed, an RFC 8594 `Sunset`header with that date; a `Link` header with `rel="successor-version"`points at the replacement. A version is only removed after a publisheddeprecation window — watch for these headers to migrate ahead of time.## Getting Started### 1. Create an API KeyIn the AutoElevate admin portal, open a **service user** and add an**API Key**. Pick a scheme at creation time:- **API Token (AE-BEARER)** — recommended for most integrations. Works with any HTTP client, iPaaS platform, SDK generator, or LLM tool.- **HMAC (AE-HMAC-SHA256)** — request-signed scheme. Signs `scheme + METHOD + URL + bodyHash + ts`, so both the request target and the body are tamper-protected, bounded by a 5-minute replay window (see below for the exact signing steps).Bearer keys show a single secret at creation. HMAC keys show **two**values — a wire `token` and a separate `hmacKey` signing key —both displayed once and never retrievable again.### 2. Authenticate**Bearer (AE-BEARER)** — send the token directly:```bashcurl https://partner-api.autoelevate.com/api/usage \ -H "Authorization: Bearer aeb_xxxxxxxxxxxxxxxxxxxxxxxx" \ -H "X-Acknowledgment: i-understand-this-is-beta-and-may-change"```**HMAC (AE-HMAC-SHA256)** — request-signed scheme. Build the`Authorization` header yourself:1. Compute `bodyHash` — the SHA-256 hex digest of the exact request body bytes. For a request with no body (GET, or a write with an empty body), use the SHA-256 of the empty string: `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` — safe to hardcode rather than recompute every time.2. Build the string to sign, joining the parts below with a real newline character (not the literal characters `\n`): ``` AE-HMAC-SHA256 <METHOD> <URL> <bodyHash> <ts> ``` `<METHOD>` is uppercase (`GET`, `POST`, ...); `<URL>` is the full request target including any query string; `<ts>` is the current time as epoch milliseconds.3. Compute `sig` — HMAC-SHA256 of that string using `hmacKey` as the key, hex-encoded.4. Send the header:```bashcurl https://partner-api.autoelevate.com/api/usage \ -H "Authorization: AE-HMAC-SHA256 token=aeh_xxx,bodyHash=<hex>,ts=<epochMs>,sig=<hex>" \ -H "X-Acknowledgment: i-understand-this-is-beta-and-may-change"````ts` must be within 5 minutes of server time or the request isrejected.### 3. Keep Your Keys Safe- **Prefer short-lived keys.** Expiration presets go down to 15 minutes — for ad-hoc testing, shared machines, or any less-trusted environment, create a short-lived key instead of reusing a long-lived one.- **Scope to least privilege.** Grant only the permissions the integration actually needs; avoid Full access keys for anything long-lived.- **Store keys in a secrets manager** — never in source control, tickets, chat, or shared documents. If a key is ever exposed, revoke it immediately in the admin portal and create a new one.- **Rotate on personnel or role changes.** Keys are tied to the service user they were created under; revoke keys that are no longer needed.## Rate LimitsLimits are applied **per MSP, per HTTP method, per route path** —each unique combination has its own bucket. Defaults during beta:| Bucket | Limit ||--------|-------|| Most endpoints | 100 requests per hour || `/api/usage` | 100 requests per hour |There is no separate per-minute burst layer today; the bucketcounter is a single sliding window. When rate-limited, the APIreturns **429 Too Many Requests** with a `Retry-After` header.Defaults are conservative for beta and may rise as the surfacestabilises.## Client LibrariesGenerate a client from the OpenAPI spec:```bashnpx @openapitools/openapi-generator-cli generate \ -i partners-openapi-spec.json \ -g typescript-fetch -o ./partners-client-ts```