API reference

The Instica EPR API lets your systems keep Products, Places and sales volumes in step, read Obligations and Estimates, and prepare Reports. Every address below is relative to https://app.instica.com/api/v1/epr. The machine-readable OpenAPI document describes the same operations.

Authentication

Send a key in the Authorization header as Bearer <key>. Create keys in Settings, API keys. Live keys start with ik_live_ and test keys with ik_test_; tokens issued to an app you connected start with iat_. A key only reaches the operations its access allows:

  • audit: audit:read
  • read: catalog:read, reports:read, fees:read, obligations:read
  • report: reports:prepare, reports:read
  • write: catalog:write, measurements:propose, volumes:write, suppliers:write, imports:write

When you rotate a key, the old secret keeps working for 24 hours so you can deploy the new one without downtime.

Versioning

The current version is 2026-10-01. Send Epr-Version: 2026-10-01 to pin your integration; without it, the version set on the key (or your workspace default) answers. Every response says which version answered in its own Epr-Version header. A version that is not published is refused with status 400 and the code unsupported_api_version. Published versions: 2026-10-01.

Retrying writes safely

Every write accepts an optional Idempotency-Key header. Send a unique value per change; if the network drops and you resend the same key with the same body within 24 hours, you get the first response again with Idempotent-Replayed: true, and nothing is done twice. The same key with a different body is refused with status 422 (idempotency_key_reused); a key whose first request is still running is refused with status 409 (idempotency_in_progress).

Errors

Every error has the same shape. code is stable and safe to branch on; message is written for people; fields names the inputs to fix; request_id matches the X-Request-ID response header, so quote it when you contact support; docs_url links to the explanation.

{
  "error": {
    "code": "validation_failed",
    "message": "Some fields need attention.",
    "fields": { "units_sold": ["Enter a whole number."] },
    "request_id": "0b8a6f0e-3c1d-4e55-9a51-6f7d2c1b9e40",
    "docs_url": "https://app.instica.com/docs/api/errors#validation_failed"
  }
}

See every error code.

Rate limits

Too many requests in a short time are refused with status 429 and the code rate_limited. The Retry-After header says how many seconds to wait before trying again.

Examples

# List your Products (send the API version you built against)
curl https://app.instica.com/api/v1/epr/skus \
  -H "Authorization: Bearer ik_test_..." \
  -H "Epr-Version: 2026-10-01"

# Create a Product; resending with the same Idempotency-Key never creates two
curl -X POST https://app.instica.com/api/v1/epr/skus \
  -H "Authorization: Bearer ik_test_..." \
  -H "Epr-Version: 2026-10-01" \
  -H "Idempotency-Key: 6f1c0d2e-order-1042" \
  -H "Content-Type: application/json" \
  -d '{"sku_code": "MUG-01", "name": "Stoneware mug"}'

Operations

Products, places, obligations and reports (264)

  • POST/allocation/compute

    Queue an allocation run for a group and year

    API keys can call this. Accepts an Idempotency-Key.

  • GET/allocation/groups

    List groups

    API keys can call this.

  • GET/allocation/policies

    List policies (filters: group_code, year)

    API keys can call this.

  • PUT/allocation/policies

    Set the method for a group and year (body: group_code, year, method, note)

    API keys can call this. Accepts an Idempotency-Key.

  • GET/allocation/results

    Return estimated allocated units, filtered to the caller's entity scope

    API keys can call this.

  • POST/assets

    Upload EPR evidence

    API keys can call this. Accepts an Idempotency-Key.

  • GET/billing/

    Get the current billing plan, entitlements and usage

    Only a signed-in person can call this.

  • POST/billing/checkout/

    Start checkout or change plan

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • POST/billing/checkout/preview/

    Preview a plan purchase or change

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • GET/billing/checkout/status/

    Check whether a checkout has activated the plan

    Only a signed-in person can call this.

  • GET/billing/entitlements/

    Plan entitlements and limits

    Only a signed-in person can call this.

  • GET/billing/invoices/

    Billing invoices

    Only a signed-in person can call this.

  • POST/billing/portal/

    Open the billing portal

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • GET/billing/usage/

    Get the records meter for the current period

    Only a signed-in person can call this.

  • GET/billing/usage/by-entity/

    Records used per client entity in a period, as CSV

    Only a signed-in person can call this.

  • GET/bulk/jobs

    List bulk jobs, newest first (filters: kind, status)

    API keys can call this.

  • POST/bulk/jobs

    Queue a bulk job from JSON rows

    API keys can call this. Accepts an Idempotency-Key.

  • GET/bulk/jobs/{uid}

    Return a bulk job

    API keys can call this.

  • GET/bulk/jobs/{uid}/result

    Download a bulk job's result file

    API keys can call this.

  • GET/bulk/kinds

    List bulk job kinds

    API keys can call this.

  • GET/clients

    List your clients and how each one stands

    Only a signed-in person can call this.

  • GET/clients/focus

    Read the client you are working on

    Only a signed-in person can call this.

  • PUT/clients/focus

    Choose the client you are working on

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • PATCH/components/{id}

    Update a packaging component

    API keys can call this. Accepts an Idempotency-Key.

  • DELETE/components/{id}

    Retire a packaging component

    API keys can call this. Accepts an Idempotency-Key.

  • GET/connectors

    List providers

    API keys can call this.

  • GET/connectors/connections/{uid}

    Return one connection

    API keys can call this.

  • DELETE/connectors/connections/{uid}

    Disconnect: revoke where the provider allows it and delete the stored credentials

    API keys can call this. Accepts an Idempotency-Key.

  • GET/connectors/connections/{uid}/runs

    Sync history, newest first

    API keys can call this.

  • POST/connectors/connections/{uid}/sync

    Queue a sync now (body: `full_resync` true to re-read from the start date)

    API keys can call this. Accepts an Idempotency-Key.

  • POST/connectors/connections/{uid}/test

    Check the stored credentials with one read call

    API keys can call this. Accepts an Idempotency-Key.

  • POST/connectors/{provider}/keys

    Verify and store the keys (encrypted)

    API keys can call this. Accepts an Idempotency-Key.

  • GET/evidence/audit-log

    List audit events; entity-restricted members are refused

    API keys can call this.

  • GET/evidence/history/{kind}/{ident}

    Read the change history of one record

    API keys can call this.

  • GET/evidence/measurements

    List measurements as evidence

    API keys can call this.

  • GET/exports

    List EPR exports

    API keys can call this.

  • POST/exports

    Request an EPR export

    API keys can call this. Accepts an Idempotency-Key.

  • GET/feeds/odata/

    OData v4 service document, `$metadata` and entity set (Power Query, Excel)

    API keys can call this.

  • GET/feeds/odata/{resource}

    OData v4 service document, `$metadata` and entity set (Power Query, Excel)

    API keys can call this.

  • GET/feeds/{feed}.{fmt}

    Read a feed as CSV or JSON (the key is sent as a header or `?key=`)

    API keys can call this.

  • GET/fees/accruals/

    List accrual exports

    API keys can call this.

  • POST/fees/accruals/

    Export a saved estimate as an accrual journal for one GL period

    API keys can call this. Accepts an Idempotency-Key.

  • GET/fees/accruals/{id}/csv/

    Return the stored CSV unchanged

    API keys can call this.

  • GET/fees/accruals/{id}/journal/{tool}/

    Download a saved fee accrual as a Xero, QuickBooks Online or NetSuite journal

    API keys can call this.

  • GET/fees/category-assignments/

    List the customer's assignments, optionally for one jurisdiction

    API keys can call this.

  • POST/fees/category-assignments/

    Assign (or reassign) a fee category for a material in a jurisdiction

    API keys can call this. Accepts an Idempotency-Key.

  • DELETE/fees/category-assignments/{id}/

    Clear a fee-category choice

    API keys can call this. Accepts an Idempotency-Key.

  • GET/fees/customer-rates/

    List entered rates, optionally for one schedule

    API keys can call this.

  • POST/fees/customer-rates/

    Create or replace the rate for one schedule and category

    API keys can call this. Accepts an Idempotency-Key.

  • DELETE/fees/customer-rates/{id}/

    Remove an entered rate

    API keys can call this. Accepts an Idempotency-Key.

  • POST/fees/estimate/

    Compute an estimate, and save it when asked

    API keys can call this. Accepts an Idempotency-Key.

  • POST/fees/estimate/skus/

    Return one row per SKU with its fee and fee per unit sold

    API keys can call this. Accepts an Idempotency-Key.

  • GET/fees/estimates/

    List saved estimates, newest period first

    API keys can call this.

  • GET/fees/estimates/{id}/

    Return one saved estimate with its lines and citations

    API keys can call this.

  • GET/fees/estimates/{id}/approvals/

    List approval requests for a saved estimate

    API keys can call this.

  • POST/fees/estimates/{id}/approvals/

    Ask a second person to approve a saved estimate

    API keys can call this. Accepts an Idempotency-Key.

  • POST/fees/estimates/{id}/approvals/{uid}/approve/

    Approve a saved estimate as the second person

    API keys can call this. Accepts an Idempotency-Key.

  • POST/fees/estimates/{id}/approvals/{uid}/reject/

    Send a saved estimate back with a note

    API keys can call this. Accepts an Idempotency-Key.

  • GET/fees/forecast/

    Return the forecast with its method stated

    API keys can call this.

  • GET/fees/fx-rates/

    List stored FX rates

    API keys can call this.

  • POST/fees/fx-rates/

    Store a rate; the same pair and date is a conflict (enter a new date instead)

    API keys can call this. Accepts an Idempotency-Key.

  • DELETE/fees/fx-rates/{id}/

    Remove a stored rate

    API keys can call this. Accepts an Idempotency-Key.

  • GET/fees/invoice-uploads/

    List uploaded invoice files, newest first

    API keys can call this.

  • POST/fees/invoice-uploads/

    Upload a PDF, image, CSV or XLSX invoice and queue it to be read

    API keys can call this. Accepts an Idempotency-Key.

  • GET/fees/invoice-uploads/{id}/

    Return one upload with its draft, per-field confidence and source snippets

    API keys can call this.

  • POST/fees/invoice-uploads/{id}/confirm/

    Save the reviewed draft as an invoice and check it against an estimate

    API keys can call this. Accepts an Idempotency-Key.

  • GET/fees/invoice-uploads/{id}/file/

    Download the original invoice file

    API keys can call this.

  • GET/fees/invoices/

    List saved invoices

    API keys can call this.

  • POST/fees/invoices/

    Save an invoice and compare it with an estimate for the same schedule and period

    API keys can call this. Accepts an Idempotency-Key.

  • GET/fees/invoices/{id}/

    Return one invoice with every variance line

    API keys can call this.

  • GET/fees/schedules/

    List schedule summaries

    API keys can call this.

  • GET/fees/schedules/{fee_id}/

    Return the schedule as published, with the customer's entered rates alongside

    API keys can call this.

  • GET/fees/settings/

    Return the settings (defaults when none were saved)

    API keys can call this.

  • PUT/fees/settings/

    Save the settings

    API keys can call this. Accepts an Idempotency-Key.

  • GET/file-flows/connections

    List connections

    API keys can call this.

  • POST/file-flows/connections

    Create a connection (credentials are stored encrypted and never returned)

    API keys can call this. Accepts an Idempotency-Key.

  • GET/file-flows/connections/{uid}

    Return one connection

    API keys can call this.

  • PATCH/file-flows/connections/{uid}

    Change a connection; changing the host clears the pinned SFTP host key

    API keys can call this. Accepts an Idempotency-Key.

  • DELETE/file-flows/connections/{uid}

    Delete a connection that no flow uses

    API keys can call this. Accepts an Idempotency-Key.

  • POST/file-flows/connections/{uid}/generate-key

    Generate a key pair; the private key is stored encrypted, the public key is returned

    API keys can call this. Accepts an Idempotency-Key.

  • POST/file-flows/connections/{uid}/host-key

    Pin the host key (body: `fingerprint`, which must match what the server presents now)

    API keys can call this. Accepts an Idempotency-Key.

  • POST/file-flows/connections/{uid}/test

    Check the connection; an unpinned SFTP host returns the presented fingerprint to confirm

    API keys can call this. Accepts an Idempotency-Key.

  • GET/file-flows/email-in

    Return the organization's import address and allowed senders

    API keys can call this.

  • PATCH/file-flows/email-in

    Set the allowed senders (addresses or `@domain`); empty allows every member

    API keys can call this. Accepts an Idempotency-Key.

  • GET/file-flows/email-in/quarantine

    Emails held for owner approval

    API keys can call this.

  • POST/file-flows/email-in/quarantine/{uid}/release

    Approve a held email and import its attachments

    API keys can call this. Accepts an Idempotency-Key.

  • POST/file-flows/email-in/rotate

    Replace the address token; the old address stops working at once

    API keys can call this. Accepts an Idempotency-Key.

  • GET/file-flows/feed-keys

    List feed keys

    API keys can call this.

  • POST/file-flows/feed-keys

    Create a read-only key for one feed; the key is shown once

    API keys can call this. Accepts an Idempotency-Key.

  • DELETE/file-flows/feed-keys/{uid}

    Revoke a feed key

    API keys can call this. Accepts an Idempotency-Key.

  • GET/file-flows/flows

    List flows (filter: `direction`)

    API keys can call this.

  • POST/file-flows/flows

    Create a flow (body: `connection_id`, `direction`, `kind`, `path_pattern`, `schedule`, ...)

    API keys can call this. Accepts an Idempotency-Key.

  • GET/file-flows/flows/{uid}

    Return one flow

    API keys can call this.

  • PATCH/file-flows/flows/{uid}

    Change a flow

    API keys can call this. Accepts an Idempotency-Key.

  • DELETE/file-flows/flows/{uid}

    Delete a flow; its run history is kept

    API keys can call this. Accepts an Idempotency-Key.

  • POST/file-flows/flows/{uid}/resume

    Resume a paused flow after fixing its cause

    API keys can call this. Accepts an Idempotency-Key.

  • POST/file-flows/flows/{uid}/run

    Run a flow now

    API keys can call this. Accepts an Idempotency-Key.

  • GET/file-flows/runs

    Run history, newest first (filter: `flow` id)

    API keys can call this.

  • GET/file-flows/runs/{uid}

    Return one run

    API keys can call this.

  • GET/file-flows/runs/{uid}/error-file

    Download the CSV of rejected rows

    API keys can call this.

  • GET/filled-templates/{id}/download

    Return the filled file for the customer to upload to the portal

    API keys can call this.

  • GET/imports/export/{kind}

    Return the CSV (entity scope applies; suppliers are org-wide so restricted members are refused)

    API keys can call this.

  • GET/imports/jobs

    List jobs, newest first (filters: kind, status)

    API keys can call this.

  • POST/imports/jobs

    Upload a file (multipart: file, kind, preset, entity, mapping, materials) and queue its processing

    API keys can call this. Accepts an Idempotency-Key.

  • GET/imports/jobs/{uid}

    Return the job

    API keys can call this.

  • GET/imports/jobs/{uid}/errors

    Download an import job's complete error file

    API keys can call this.

  • POST/imports/jobs/{uid}/mapping

    Attach the mapping and queue the job again

    API keys can call this. Accepts an Idempotency-Key.

  • GET/imports/presets

    List presets

    API keys can call this.

  • POST/imports/preview

    Preview a table file (multipart: file, preset, mapping, materials); nothing is saved

    API keys can call this. Accepts an Idempotency-Key.

  • POST/me/organization

    Switch the active organization

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • GET/me/organizations

    List the caller's organizations and roles

    Only a signed-in person can call this.

  • GET/me/personal-data

    Return the caller's personal-data requests

    Only a signed-in person can call this.

  • POST/me/personal-data/deletion

    Schedule deletion of the caller's account (step-up required)

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • POST/me/personal-data/deletion/{uid}/cancel

    Cancel a scheduled account deletion

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • POST/me/personal-data/exports

    Request a personal data export

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • GET/me/personal-data/exports/{uid}/download

    Download a personal data export

    Only a signed-in person can call this.

  • GET/measurements

    List EPR measurements

    API keys can call this.

  • POST/measurements

    Confirm an EPR measurement

    API keys can call this. Accepts an Idempotency-Key.

  • GET/measurements/proposals

    List measurement proposals

    API keys can call this.

  • GET/measurements/proposals/{uid}

    Read a measurement proposal

    API keys can call this.

  • POST/measurements/proposals/{uid}/confirm

    Confirm a measurement proposal

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • POST/measurements/proposals/{uid}/reject

    Reject a measurement proposal

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • POST/measurements/{uid}/supersede

    Supersede an EPR measurement

    API keys can call this. Accepts an Idempotency-Key.

  • POST/measurements/{uid}/void

    Void an EPR measurement

    API keys can call this. Accepts an Idempotency-Key.

  • GET/notifications/

    List notifications

    API keys can call this.

  • GET/notifications/change-feed/

    List change notices

    API keys can call this.

  • GET/notifications/preferences/

    Return every kind and channel with the caller's effective setting

    API keys can call this.

  • PUT/notifications/preferences/

    Apply preference changes

    API keys can call this. Accepts an Idempotency-Key.

  • POST/notifications/read-all/

    Mark everything read

    API keys can call this. Accepts an Idempotency-Key.

  • GET/notifications/unread-count/

    Return the number of unread notifications

    API keys can call this.

  • POST/notifications/{uid}/read/

    Mark one notification read; someone else's notification is a 404

    API keys can call this. Accepts an Idempotency-Key.

  • POST/public/obligations/preview

    Evaluate one anonymous entity against the requested regions

    API keys can call this. Accepts an Idempotency-Key.

  • POST/public/obligations/preview/

    Evaluate one anonymous entity against the requested regions

    API keys can call this. Accepts an Idempotency-Key.

  • GET/quality/access

    Return role, read-only status, AI-assist state and the check catalogue

    API keys can call this.

  • GET/quality/flags

    List flags

    API keys can call this.

  • GET/quality/flags/{id}

    Return one flag with its check numbers

    API keys can call this.

  • POST/quality/flags/{id}/assign

    Assign (or clear with `assignee_id: null`) the flag's assignee

    API keys can call this. Accepts an Idempotency-Key.

  • POST/quality/flags/{id}/explain

    Explain a flag; the explanation must be substantive

    API keys can call this. Accepts an Idempotency-Key.

  • POST/quality/flags/{id}/reopen

    Reopen a resolved or explained flag with a reason

    API keys can call this. Accepts an Idempotency-Key.

  • POST/quality/flags/{id}/resolve

    Resolve a flag; a note saying what changed is required

    API keys can call this. Accepts an Idempotency-Key.

  • GET/quality/periods/{id}/gate

    Return the flags that stop the period locking (empty means it can lock)

    API keys can call this.

  • GET/quality/runs

    List recent runs

    API keys can call this.

  • POST/quality/runs

    Run the checks now (optionally for one SKU); AI runs only when AI assist is on

    API keys can call this. Accepts an Idempotency-Key.

  • GET/registration-packs

    List stored packs

    API keys can call this.

  • POST/registration-packs

    Generate a pack for an entity, jurisdiction and year

    API keys can call this. Accepts an Idempotency-Key.

  • GET/registration-packs/{id}

    Return the pack with its sections and gaps

    API keys can call this.

  • GET/registration-packs/{id}/download

    Return the pack file

    API keys can call this.

  • GET/registrations

    List registration numbers

    API keys can call this.

  • POST/registrations

    Record a registration number the customer received

    API keys can call this. Accepts an Idempotency-Key.

  • GET/registrations/options

    Return in-scope entities and every jurisdiction we hold data for

    API keys can call this.

  • GET/registrations/{id}

    Return one registration

    API keys can call this.

  • PATCH/registrations/{id}

    Change a registration

    API keys can call this. Accepts an Idempotency-Key.

  • DELETE/registrations/{id}

    Remove a registration that was entered by mistake

    API keys can call this. Accepts an Idempotency-Key.

  • GET/regulatory-updates/

    List the organization's change notices

    API keys can call this.

  • POST/regulatory-updates/read-all/

    Mark every notice of the organization read

    API keys can call this. Accepts an Idempotency-Key.

  • GET/regulatory-updates/unread-count/

    Return how many notices are unread

    API keys can call this.

  • POST/regulatory-updates/{uid}/read/

    Mark one notice read; another organization's notice is a 404

    API keys can call this. Accepts an Idempotency-Key.

  • GET/reports/periods/{period_id}/journal/{tool}/

    Download a period's fee accrual journal for Xero, QuickBooks Online or NetSuite

    API keys can call this.

  • GET/reusable-supply

    List the reusable units first supplied

    API keys can call this.

  • POST/reusable-supply

    Record reusable units first supplied

    API keys can call this. Accepts an Idempotency-Key.

  • PATCH/reusable-supply/{id}

    Edit reusable units first supplied

    API keys can call this. Accepts an Idempotency-Key.

  • DELETE/reusable-supply/{id}

    Delete reusable units first supplied

    API keys can call this. Accepts an Idempotency-Key.

  • GET/sampling/estimates

    List estimates

    API keys can call this.

  • POST/sampling/estimates

    Propose an estimate for a component from `supplier_declaration`

    API keys can call this. Accepts an Idempotency-Key.

  • POST/sampling/estimates/{id}/accept

    Apply the estimate to the component (never over a measured weight)

    API keys can call this. Accepts an Idempotency-Key.

  • POST/sampling/estimates/{id}/reject

    Reject the estimate; the component is untouched

    API keys can call this. Accepts an Idempotency-Key.

  • GET/sampling/plans

    List plans

    API keys can call this.

  • POST/sampling/plans

    Create a plan; strata and sizes follow the stated formula

    API keys can call this. Accepts an Idempotency-Key.

  • GET/sampling/plans/{id}

    Return the plan, its draws, per-stratum variance, open triggers and the tier rollup

    API keys can call this.

  • POST/sampling/plans/{id}/baseline

    Freeze the current statistics as the baseline

    API keys can call this. Accepts an Idempotency-Key.

  • POST/sampling/plans/{id}/check

    Compare strata to the baseline and open re-measure triggers

    API keys can call this. Accepts an Idempotency-Key.

  • POST/sampling/plans/{id}/draw

    Draw (or top up) the deterministic sample for each stratum

    API keys can call this. Accepts an Idempotency-Key.

  • POST/sampling/plans/{id}/sync

    Link pending draws to measurements confirmed since they were drawn

    API keys can call this. Accepts an Idempotency-Key.

  • GET/sampling/triggers

    List triggers

    API keys can call this.

  • POST/sampling/triggers/{id}/clear

    Clear with a note (re-measured, or why the change does not matter)

    API keys can call this. Accepts an Idempotency-Key.

  • POST/sampling/triggers/{id}/remeasure

    Put the stratum's draws back to pending

    API keys can call this. Accepts an Idempotency-Key.

  • GET/shipping-profiles

    List the organization's shipping profiles with the grams per shipment each implies

    API keys can call this.

  • POST/shipping-profiles

    Create a shipping profile

    API keys can call this. Accepts an Idempotency-Key.

  • PATCH/shipping-profiles/{id}

    Edit a shipping profile

    API keys can call this. Accepts an Idempotency-Key.

  • DELETE/shipping-profiles/{id}

    Delete a shipping profile

    API keys can call this. Accepts an Idempotency-Key.

  • GET/shipping-tonnage

    Return tonnage rows plus what is missing (filters: period_start, period_end, jurisdiction)

    API keys can call this.

  • GET/skus

    List packaging SKUs

    API keys can call this.

  • POST/skus

    Create a packaging SKU

    API keys can call this. Accepts an Idempotency-Key.

  • POST/skus/import

    Import packaging SKUs

    API keys can call this. Accepts an Idempotency-Key.

  • GET/skus/{id}

    Get a packaging SKU

    API keys can call this.

  • PATCH/skus/{id}

    Update a packaging SKU

    API keys can call this. Accepts an Idempotency-Key.

  • DELETE/skus/{id}

    Retire a packaging SKU

    API keys can call this. Accepts an Idempotency-Key.

  • GET/skus/{sku_id}/bundle-components

    List what the SKU contains, and which bundles contain it

    API keys can call this.

  • PUT/skus/{sku_id}/bundle-components/{component_id}

    Add a component to the bundle, or change its quantity or dates

    API keys can call this. Accepts an Idempotency-Key.

  • DELETE/skus/{sku_id}/bundle-components/{component_id}

    Remove a component from the bundle (``effective_from`` picks one dated row)

    API keys can call this. Accepts an Idempotency-Key.

  • GET/skus/{sku_id}/components

    List packaging components

    API keys can call this.

  • POST/skus/{sku_id}/components

    Create a packaging component

    API keys can call this. Accepts an Idempotency-Key.

  • PUT/skus/{sku_id}/spec-links/{spec_id}

    Link the spec to the SKU, or change the units per SKU

    API keys can call this. Accepts an Idempotency-Key.

  • DELETE/skus/{sku_id}/spec-links/{spec_id}

    Unlink a shared spec from the SKU (a SKU's own private spec cannot be unlinked)

    API keys can call this. Accepts an Idempotency-Key.

  • GET/skus/{sku_id}/volumes

    List SKU state volumes

    API keys can call this.

  • PUT/skus/{sku_id}/volumes

    Replace SKU state volumes

    API keys can call this. Accepts an Idempotency-Key.

  • PATCH/spec-components/{id}

    Edit any attribute of a component

    API keys can call this. Accepts an Idempotency-Key.

  • DELETE/spec-components/{id}

    Retire a component (measurements stay)

    API keys can call this. Accepts an Idempotency-Key.

  • PUT/spec-components/{id}/layers

    Replace the layers; the component weight becomes their sum

    API keys can call this. Accepts an Idempotency-Key.

  • GET/spec-families

    List families with their spec counts

    API keys can call this.

  • POST/spec-families

    Create a family

    API keys can call this. Accepts an Idempotency-Key.

  • PATCH/spec-families/{id}

    Rename a family or edit its notes

    API keys can call this. Accepts an Idempotency-Key.

  • DELETE/spec-families/{id}

    Delete a family; its specs stay and lose the grouping

    API keys can call this. Accepts an Idempotency-Key.

  • GET/specs

    List specs; private per-SKU specs only with `include_private=1`

    API keys can call this.

  • POST/specs

    Create a spec

    API keys can call this. Accepts an Idempotency-Key.

  • GET/specs/{id}

    Return the spec with components, layers and linked SKUs

    API keys can call this.

  • PATCH/specs/{id}

    Update a spec; every linked SKU sees the change

    API keys can call this. Accepts an Idempotency-Key.

  • DELETE/specs/{id}

    Retire a spec (its measurement history is kept)

    API keys can call this. Accepts an Idempotency-Key.

  • POST/specs/{id}/approve

    Approve the spec's current draft revision

    API keys can call this. Accepts an Idempotency-Key.

  • GET/specs/{id}/revisions

    List the spec's approved revisions, newest first

    API keys can call this.

  • POST/specs/{spec_id}/components

    Create a component on a spec shared by every SKU that links it

    API keys can call this. Accepts an Idempotency-Key.

  • GET/specs/{spec_id}/photos

    List the spec's photos in display order

    API keys can call this.

  • POST/specs/{spec_id}/photos

    Upload a photo of the spec (PNG, JPEG or WebP, up to 10 MB); it goes last

    API keys can call this. Accepts an Idempotency-Key.

  • POST/specs/{spec_id}/photos/order

    Set the display order of the spec's photos

    API keys can call this. Accepts an Idempotency-Key.

  • PATCH/specs/{spec_id}/photos/{id}

    Change a photo's caption

    API keys can call this. Accepts an Idempotency-Key.

  • DELETE/specs/{spec_id}/photos/{id}

    Delete a photo (evidence images it was copied from are kept)

    API keys can call this. Accepts an Idempotency-Key.

  • GET/specs/{spec_id}/photos/{id}/file

    Stream one photo's image

    API keys can call this.

  • GET/submissions

    List report versions

    API keys can call this.

  • GET/submissions/{id}

    Return the status, filled templates and the portal walkthrough

    API keys can call this.

  • POST/submissions/{id}/fill

    Fill the uploaded template using a saved mapping

    API keys can call this. Accepts an Idempotency-Key.

  • GET/submissions/{id}/receipt

    Download the stored receipt

    API keys can call this.

  • POST/submissions/{id}/receipt

    Store the receipt file the customer downloaded from the portal

    API keys can call this. Accepts an Idempotency-Key.

  • POST/submissions/{id}/status

    Record submitted, acknowledged or rejected, with the portal reference

    API keys can call this. Accepts an Idempotency-Key.

  • GET/supplier-declarations

    List declarations

    API keys can call this.

  • POST/supplier-declarations/{id}/re-request

    Create a renewal request for the declaration's component

    API keys can call this. Accepts an Idempotency-Key.

  • POST/supplier-documents

    Store the upload and create proposals; nothing is measured until a proposal is accepted

    API keys can call this. Accepts an Idempotency-Key.

  • GET/supplier-documents/{id}/file

    Download a supplier document as an attachment

    API keys can call this.

  • GET/supplier-proposals

    List proposals

    API keys can call this.

  • POST/supplier-proposals

    Record figures read from a supplier document as a pending proposal

    API keys can call this. Accepts an Idempotency-Key.

  • GET/supplier-proposals/{id}

    Return one proposal

    API keys can call this.

  • POST/supplier-proposals/{id}/accept

    Accept the proposal, applying any edits sent in `changes`

    API keys can call this. Accepts an Idempotency-Key.

  • POST/supplier-proposals/{id}/reject

    Reject the proposal with an optional note

    API keys can call this. Accepts an Idempotency-Key.

  • GET/supplier-request-components

    List in-scope active components with their SKU name

    API keys can call this.

  • GET/supplier-requests

    List requests

    API keys can call this.

  • POST/supplier-requests

    Create a request for chosen components; the response carries the link once

    API keys can call this. Accepts an Idempotency-Key.

  • GET/supplier-requests/{id}

    Return one request with its components and seats

    API keys can call this.

  • POST/supplier-requests/{id}/cancel

    Cancel the request and revoke its links

    API keys can call this. Accepts an Idempotency-Key.

  • POST/supplier-requests/{id}/remind

    Record a reminder, issuing a fresh link (the old one stops working)

    API keys can call this. Accepts an Idempotency-Key.

  • GET/suppliers

    List the organization's suppliers

    API keys can call this.

  • POST/suppliers

    Create a supplier

    API keys can call this. Accepts an Idempotency-Key.

  • GET/suppliers/{id}

    Return one supplier

    API keys can call this.

  • PATCH/suppliers/{id}

    Update name, contact email, notes or active state

    API keys can call this. Accepts an Idempotency-Key.

  • GET/support/tickets/

    List the organization's tickets, newest activity first

    API keys can call this.

  • POST/support/tickets/

    Open a ticket from the in-app help panel

    API keys can call this. Accepts an Idempotency-Key.

  • GET/support/tickets/{uid}/

    Return a ticket and its messages without internal notes

    API keys can call this.

  • POST/support/tickets/{uid}/messages/

    Add a customer reply; a closed ticket reopens

    API keys can call this. Accepts an Idempotency-Key.

  • GET/taxonomy

    List EPR material categories

    API keys can call this.

  • POST/teardowns

    Start a packaging teardown

    API keys can call this. Accepts an Idempotency-Key.

  • GET/teardowns/{id}

    Get a packaging teardown

    API keys can call this.

  • GET/teardowns/{id}/analysis

    Get teardown analysis

    API keys can call this.

  • POST/teardowns/{id}/analyze

    Analyze teardown evidence

    API keys can call this. Accepts an Idempotency-Key.

  • POST/teardowns/{id}/complete

    Complete a packaging teardown

    API keys can call this. Accepts an Idempotency-Key.

  • GET/template-mappings

    List the organization's saved mappings

    API keys can call this.

  • POST/template-mappings

    Save the mapping for an uploaded template (the file identifies the template)

    API keys can call this. Accepts an Idempotency-Key.

  • POST/templates/preview

    Return the template's headings, a suggested mapping, and any saved mapping for it

    API keys can call this. Accepts an Idempotency-Key.

  • POST/uploads

    Issue an upload URL (body: `kind`, `preset`, `filename`, `entity`); valid for 15 minutes

    API keys can call this. Accepts an Idempotency-Key.

  • POST/uploads/{token}

    Upload the file (raw body) and import it

    API keys can call this. Accepts an Idempotency-Key.

  • PUT/uploads/{token}

    Upload the file (raw body) and import it

    API keys can call this. Accepts an Idempotency-Key.

  • GET/walkthroughs/{code}

    Return ordered steps, each citing its source leaf

    API keys can call this.

  • POST/workspaces

    Create an EPR workspace

    API keys can call this. Accepts an Idempotency-Key.

  • GET/workspaces/current

    Get the current EPR workspace

    API keys can call this.

  • PATCH/workspaces/current

    Update the current EPR workspace

    API keys can call this. Accepts an Idempotency-Key.

  • POST/workspaces/current/accept-terms

    Accept the current EPR terms

    API keys can call this. Accepts an Idempotency-Key.

  • GET/workspaces/current/session

    Who is signing in on the start page

    API keys can call this.

Keys, webhooks, audit and data rights (46)

  • GET/account-closure

    Account closure policy and status

    Only a signed-in person can call this.

  • GET/api-keys

    List API keys

    Only a signed-in person can call this.

  • POST/api-keys

    Create an API key

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • GET/api-keys/{uid}

    Get an API key

    Only a signed-in person can call this.

  • DELETE/api-keys/{uid}

    Revoke an API key

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • POST/api-keys/{uid}/rotate

    Rotate an API key

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • GET/api-version

    Get the default API version

    Only a signed-in person can call this.

  • PUT/api-version

    Pin the default API version

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • GET/audit-events

    List audit events

    API keys can call this. Needs: audit:read.

  • GET/audit-events/export

    Export audit events as CSV

    API keys can call this. Needs: audit:read.

  • POST/audit-events/verify

    Check the audit log's hash chain

    API keys can call this. Needs: audit:read. Accepts an Idempotency-Key.

  • GET/data-deletions

    List deletion requests

    Only a signed-in person can call this.

  • POST/data-deletions

    Close the account and delete the organization's data

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • POST/data-deletions/{uid}/cancel

    Cancel a scheduled deletion

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • GET/data-exports

    List data exports

    Only a signed-in person can call this.

  • POST/data-exports

    Request a GDPR/CCPA data export

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • GET/data-exports/{uid}/download

    Download a data export

    Only a signed-in person can call this.

  • GET/oauth/authorize

    Validate an authorization request for the consent screen

    Only a signed-in person can call this.

  • POST/oauth/authorize

    Approve or deny an authorization request

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • POST/oauth/introspect

    Introspect an access token

    API keys can call this. Accepts an Idempotency-Key.

  • POST/oauth/register

    Register an OAuth client (dynamic client registration)

    API keys can call this. Accepts an Idempotency-Key.

  • POST/oauth/revoke

    Revoke an access token

    API keys can call this. Accepts an Idempotency-Key.

  • POST/oauth/token

    Get an access token (OAuth2 client credentials)

    API keys can call this. Accepts an Idempotency-Key.

  • GET/sandbox

    Get the sandbox organization

    Only a signed-in person can call this.

  • POST/sandbox

    Create the sandbox organization

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • GET/service-accounts

    List service accounts

    Only a signed-in person can call this.

  • POST/service-accounts

    Create a service account

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • GET/service-accounts/{uid}

    Get a service account

    Only a signed-in person can call this.

  • DELETE/service-accounts/{uid}

    Revoke a service account

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • POST/service-accounts/{uid}/rotate

    Rotate a service account

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • GET/team

    Team overview

    Only a signed-in person can call this.

  • POST/team/external-auditors

    Invite an external auditor

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • PUT/team/members/{member_uid}/approval-right

    Grant or revoke the spec-approval right

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • PUT/team/members/{member_uid}/entity-scope

    Set a member's entity scope

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • POST/team/members/{member_uid}/revoke-external-access

    End an external auditor's access now

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • PUT/team/members/{member_uid}/signing-right

    Grant or revoke the report-signing right

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • POST/team/transfer-ownership

    Transfer ownership

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • GET/webhook-deliveries

    List webhook deliveries

    API keys can call this. Needs: webhooks:manage.

  • POST/webhook-deliveries/{uid}/redeliver

    Redeliver an event

    API keys can call this. Needs: webhooks:manage. Accepts an Idempotency-Key.

  • GET/webhook-endpoints

    List webhook endpoints

    API keys can call this. Needs: webhooks:manage.

  • POST/webhook-endpoints

    Create a webhook endpoint

    API keys can call this. Needs: webhooks:manage. Accepts an Idempotency-Key.

  • GET/webhook-endpoints/{uid}

    Get a webhook endpoint

    API keys can call this. Needs: webhooks:manage.

  • PATCH/webhook-endpoints/{uid}

    Change a webhook endpoint

    API keys can call this. Needs: webhooks:manage. Accepts an Idempotency-Key.

  • DELETE/webhook-endpoints/{uid}

    Delete a webhook endpoint

    API keys can call this. Needs: webhooks:manage. Accepts an Idempotency-Key.

  • POST/webhook-endpoints/{uid}/rotate-secret

    Rotate a webhook signing secret

    API keys can call this. Needs: webhooks:manage. Accepts an Idempotency-Key.

  • GET/webhook-events

    List webhook event types

    API keys can call this. Needs: webhooks:manage.

Sign-in and security (53)

  • GET/identity/audit-retention

    Return the audit-log retention period

    Only a signed-in person can call this.

  • PATCH/identity/audit-retention

    Change the audit-log retention period (step-up required)

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • GET/identity/break-glass-owners

    List the owners and which of them are break-glass owners

    Only a signed-in person can call this.

  • PUT/identity/break-glass-owners

    Name the break-glass owners (owner only, step-up required)

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • GET/identity/domains

    List claimed domains

    Only a signed-in person can call this.

  • POST/identity/domains

    Claim a domain; publish the returned TXT value to verify it

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • PATCH/identity/domains/{uid}

    Turn SSO enforcement on or off (step-up required)

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • DELETE/identity/domains/{uid}

    Remove a domain claim

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • POST/identity/domains/{uid}/verify

    Look up the TXT record now

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • GET/identity/ip-allowlist

    Return the IP allowlist

    Only a signed-in person can call this.

  • PATCH/identity/ip-allowlist

    Change the IP allowlist (step-up required)

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • GET/identity/legal-holds

    List legal holds

    Only a signed-in person can call this.

  • POST/identity/legal-holds

    Place a legal hold (step-up required)

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • POST/identity/legal-holds/{uid}/release

    Release a legal hold (step-up required)

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • GET/identity/mfa

    Factors, assurance level of this session and the org requirement

    Only a signed-in person can call this.

  • DELETE/identity/mfa/factors/{factor}

    Remove a factor (step-up required; another factor must remain)

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • POST/identity/mfa/recovery-codes

    Generate 10 new single-use codes (replacing the old set); shown once

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • GET/identity/mfa/recovery-requests

    Pending requests for the organization

    Only a signed-in person can call this.

  • POST/identity/mfa/recovery-requests

    Open a request for a member who lost every factor

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • POST/identity/mfa/recovery-requests/self

    Ask for a sign-in reset after losing every factor

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • POST/identity/mfa/recovery-requests/{uid}/decide

    Approve or deny

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • POST/identity/mfa/recovery-requests/{uid}/operator-decide

    Staff approval of a sole owner's recovery

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • POST/identity/mfa/totp/begin

    Start authenticator enrolment; the secret is shown once

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • POST/identity/mfa/totp/confirm

    Confirm the authenticator with a first code; the session becomes AAL2

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • POST/identity/mfa/verify

    Verify a TOTP or recovery code (locked out after repeated failures)

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • POST/identity/mfa/webauthn/authenticate/begin

    Return request options

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • POST/identity/mfa/webauthn/authenticate/complete

    Verify the assertion; a passkey with user verification reaches AAL2

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • POST/identity/mfa/webauthn/register/begin

    Return creation options

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • POST/identity/mfa/webauthn/register/complete

    Verify and store the passkey

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • GET/identity/oidc/callback

    Finish an OpenID Connect sign-in

    API keys can call this.

  • GET/identity/oidc/presets

    List OpenID Connect presets

    Only a signed-in person can call this.

  • GET/identity/oidc/{uid}/start

    Start an OpenID Connect sign-in

    API keys can call this.

  • GET/identity/providers

    List SSO connections

    Only a signed-in person can call this.

  • POST/identity/providers

    Create an SSO connection (step-up required)

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • GET/identity/providers/{uid}

    One connection

    Only a signed-in person can call this.

  • PATCH/identity/providers/{uid}

    Edit a connection (step-up required)

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • DELETE/identity/providers/{uid}

    Remove a connection (step-up required)

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • GET/identity/providers/{uid}/rules

    List group-to-role rules

    Only a signed-in person can call this.

  • POST/identity/providers/{uid}/rules

    Add a rule (step-up required)

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • DELETE/identity/providers/{uid}/rules/{rule_uid}

    Remove a rule

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • GET/identity/providers/{uid}/saml-metadata

    Download the service-provider metadata

    Only a signed-in person can call this.

  • GET/identity/scim-tokens

    List tokens (never the secret)

    Only a signed-in person can call this.

  • POST/identity/scim-tokens

    Mint a token; the secret is returned once (step-up required)

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • DELETE/identity/scim-tokens/{uid}

    Revoke a token

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • GET/identity/security-policy

    Return the policy

    Only a signed-in person can call this.

  • PATCH/identity/security-policy

    Change the policy (step-up required)

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • GET/identity/sessions

    Active sessions of the caller

    Only a signed-in person can call this.

  • POST/identity/sessions/revoke-all

    Revoke every other session of the caller

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • DELETE/identity/sessions/{uid}

    Revoke one of the caller's sessions

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • GET/identity/signin/methods

    List enabled sign-in methods

    API keys can call this.

  • POST/identity/signin/passkey/begin

    Start a passkey sign-in

    API keys can call this. Accepts an Idempotency-Key.

  • POST/identity/signin/passkey/complete

    Finish a passkey sign-in

    API keys can call this. Accepts an Idempotency-Key.

  • GET/identity/sso/discover

    Return only whether SSO applies and where to start it

    API keys can call this.

Instica operations staff (25)

  • GET/ops/data-files/

    Return every jurisdiction, fee and report-format file

    API keys can call this.

  • GET/ops/data-files/leaves/

    Return `{pointer, value, status}` for each leaf of `?path=`

    API keys can call this.

  • GET/ops/data-proposals/

    List proposals

    API keys can call this.

  • POST/ops/data-proposals/

    Create a draft proposal

    API keys can call this. Accepts an Idempotency-Key.

  • GET/ops/data-proposals/{uid}/

    Return the proposal with its reviews

    API keys can call this.

  • PATCH/ops/data-proposals/{uid}/

    Edit a draft or rejected proposal (proposer only); it returns to draft

    API keys can call this. Accepts an Idempotency-Key.

  • POST/ops/data-proposals/{uid}/apply/

    Return the diff and patched file text; an engineer lands them through a normal commit

    API keys can call this. Accepts an Idempotency-Key.

  • POST/ops/data-proposals/{uid}/approve/

    Approve; the two-person rule is enforced server-side

    API keys can call this. Accepts an Idempotency-Key.

  • GET/ops/data-proposals/{uid}/diff/

    Return the diff (stored for an applied proposal); 409 `stale` when the file changed

    API keys can call this.

  • GET/ops/data-proposals/{uid}/download/

    Return an attachment

    API keys can call this.

  • POST/ops/data-proposals/{uid}/reject/

    Reject with a comment; the two-person rule is enforced server-side

    API keys can call this. Accepts an Idempotency-Key.

  • POST/ops/data-proposals/{uid}/submit/

    Move a draft to submitted (proposer only)

    API keys can call this. Accepts an Idempotency-Key.

  • GET/ops/impersonation/

    Cursor-paged history, newest first

    API keys can call this.

  • GET/ops/impersonation/current/

    Return the open session or ``{"session": null}``; expired sessions are closed here

    API keys can call this.

  • POST/ops/impersonation/end/

    Close the session and audit it

    API keys can call this. Accepts an Idempotency-Key.

  • POST/ops/impersonation/start/

    Open a session on the user named by `user_id` or `email`; `reason` is required

    API keys can call this. Accepts an Idempotency-Key.

  • GET/ops/regulatory/changes/

    List changes

    API keys can call this.

  • GET/ops/regulatory/changes/{uid}/

    Return one change with its diff

    API keys can call this.

  • POST/ops/regulatory/changes/{uid}/approve/

    Approve as a second staff member; affected organizations are notified

    API keys can call this. Accepts an Idempotency-Key.

  • GET/ops/regulatory/changes/{uid}/diff/

    Return only the unified diff of one change

    API keys can call this.

  • POST/ops/regulatory/changes/{uid}/dismiss/

    Dismiss a change as noise

    API keys can call this. Accepts an Idempotency-Key.

  • POST/ops/regulatory/changes/{uid}/reject/

    Reject an in-review change (a comment is required); nobody is notified

    API keys can call this. Accepts an Idempotency-Key.

  • POST/ops/regulatory/changes/{uid}/submit/

    Put an open change into review with a plain-language summary

    API keys can call this. Accepts an Idempotency-Key.

  • POST/ops/regulatory/run/

    Queue a watch run (optionally for some source keys); returns 202

    API keys can call this. Accepts an Idempotency-Key.

  • GET/ops/regulatory/sources/

    List watched sources

    API keys can call this.

Public (no sign-in) (23)

  • GET/public/calendar/{token}.ics

    Return the deadline calendar for a feed token

    API keys can call this.

  • GET/public/jwks

    Return the JWKS of every public key that has signed EPR output

    API keys can call this.

  • GET/public/jwks/

    Return the JWKS of every public key that has signed EPR output

    API keys can call this.

  • GET/public/plan-catalog

    Return the EPR plan catalog document: prices, limits and plan-gated capabilities

    API keys can call this.

  • GET/public/plan-catalog/

    Return the EPR plan catalog document: prices, limits and plan-gated capabilities

    API keys can call this.

  • GET/public/plans

    Return the EPR plan catalog with prices in integer cents

    API keys can call this.

  • GET/public/plans/

    Return the EPR plan catalog with prices in integer cents

    API keys can call this.

  • GET/public/status

    Return the public service status

    API keys can call this.

  • GET/public/status/

    Return the public service status

    API keys can call this.

  • GET/public/supply/{token}

    Return the request contract: who asks, until when, and for which components

    API keys can call this.

  • POST/public/supply/{token}

    Store the supplier's answer as proposals awaiting the customer's confirmation

    API keys can call this. Accepts an Idempotency-Key.

  • GET/public/supply/{token}/

    Return the request contract: who asks, until when, and for which components

    API keys can call this.

  • POST/public/supply/{token}/

    Store the supplier's answer as proposals awaiting the customer's confirmation

    API keys can call this. Accepts an Idempotency-Key.

  • POST/public/supply/{token}/documents

    Store a supporting file for the request after checking it is an inert PDF or image

    API keys can call this. Accepts an Idempotency-Key.

  • POST/public/supply/{token}/documents/

    Store a supporting file for the request after checking it is an inert PDF or image

    API keys can call this. Accepts an Idempotency-Key.

  • GET/public/terms

    Return the current EPR terms document

    API keys can call this.

  • GET/public/terms/

    Return the current EPR terms document

    API keys can call this.

  • GET/public/trust

    List the public trust documents

    API keys can call this.

  • GET/public/trust/

    List the public trust documents

    API keys can call this.

  • GET/public/trust/{slug}

    Return one trust document, or 404 `trust_document_not_found`

    API keys can call this.

  • GET/public/trust/{slug}/

    Return one trust document, or 404 `trust_document_not_found`

    API keys can call this.

  • GET/public/verify/{report_hash}

    Return the verification payload, or 404 `report_not_found`

    API keys can call this.

  • GET/public/verify/{report_hash}/

    Return the verification payload, or 404 `report_not_found`

    API keys can call this.

SCIM provisioning (15)

  • GET/scim/v2/Groups

    List groups

    API keys can call this.

  • POST/scim/v2/Groups

    Create a group

    API keys can call this. Accepts an Idempotency-Key.

  • GET/scim/v2/Groups/{uid}

    Get a SCIM group

    API keys can call this.

  • PUT/scim/v2/Groups/{uid}

    Replace a SCIM group

    API keys can call this. Accepts an Idempotency-Key.

  • PATCH/scim/v2/Groups/{uid}

    Patch a SCIM group

    API keys can call this. Accepts an Idempotency-Key.

  • DELETE/scim/v2/Groups/{uid}

    Delete the group (members keep their memberships)

    API keys can call this. Accepts an Idempotency-Key.

  • GET/scim/v2/ResourceTypes

    Resource types

    API keys can call this.

  • GET/scim/v2/Schemas

    List the SCIM schemas

    API keys can call this.

  • GET/scim/v2/ServiceProviderConfig

    Capabilities

    API keys can call this.

  • GET/scim/v2/Users

    List provisioned users

    API keys can call this.

  • POST/scim/v2/Users

    Provision a user

    API keys can call this. Accepts an Idempotency-Key.

  • GET/scim/v2/Users/{uid}

    Get a SCIM user

    API keys can call this.

  • PUT/scim/v2/Users/{uid}

    Replace a SCIM user

    API keys can call this. Accepts an Idempotency-Key.

  • PATCH/scim/v2/Users/{uid}

    Patch a SCIM user

    API keys can call this. Accepts an Idempotency-Key.

  • DELETE/scim/v2/Users/{uid}

    Deprovision (deactivate, never delete data)

    API keys can call this. Accepts an Idempotency-Key.

MCP for AI assistants (5)

  • GET/mcp/

    No server-initiated stream: `405` as the transport allows

    API keys can call this.

  • POST/mcp/

    Handle one JSON-RPC message

    API keys can call this.

  • DELETE/mcp/

    No sessions to end: `405`

    API keys can call this.

  • GET/mcp/oauth-authorization-server

    Describe the OAuth authorization server

    API keys can call this.

  • GET/mcp/oauth-protected-resource

    Describe the resource, its token issuer origin and the scopes it understands

    API keys can call this.

Analytics (1)

  • GET/analytics/funnel/

    Return events, organizations and people per step, in funnel order

    API keys can call this.

Assistant (2)

  • POST/assistant/ask/

    Ask the assistant about this organization's EPR data

    API keys can call this. Accepts an Idempotency-Key.

  • GET/assistant/status/

    Report whether the assistant is available

    API keys can call this.

Events (1)

  • POST/events/

    Validate and store up to `MAX_BATCH` events; per-event problems are reported, not fatal

    API keys can call this. Accepts an Idempotency-Key.

Fees (3)

  • GET/fees/sources/

    List the fee and threshold source table

    API keys can call this.

  • POST/fees/sources/watches/

    Ask to be emailed when an awaited schedule or layout is published

    API keys can call this. Accepts an Idempotency-Key.

  • DELETE/fees/sources/watches/{uid}/

    Stop watching an awaited schedule or layout

    API keys can call this. Accepts an Idempotency-Key.

Home (2)

  • GET/home/summary/

    Return all sections, the onboarding checklist and the next-actions list

    API keys can call this.

  • GET/home/summary/{section}/

    Return one section; unknown sections are 404

    API keys can call this.

Labelling (9)

  • GET/labelling/certificates/

    Return one cursor page of stored certificates, newest first

    API keys can call this.

  • POST/labelling/certificates/

    Store a certificate for a component of the caller's organization

    API keys can call this. Accepts an Idempotency-Key.

  • GET/labelling/certificates/{uid}/

    Return one stored certificate

    API keys can call this.

  • PATCH/labelling/certificates/{uid}/

    Update the fields given; the component cannot change

    API keys can call this. Accepts an Idempotency-Key.

  • DELETE/labelling/certificates/{uid}/

    Delete a stored certificate and its file

    API keys can call this. Accepts an Idempotency-Key.

  • GET/labelling/components/{id}/

    Evaluate one component in the requested markets

    API keys can call this.

  • GET/labelling/conflicts/

    Return one page of conflicts across the caller's visible components

    API keys can call this.

  • GET/labelling/markets/

    List the markets the labelling rules cover

    API keys can call this.

  • GET/labelling/skus/{id}/

    Evaluate every component of one SKU in the requested markets

    API keys can call this.

Obligations (7)

  • POST/obligations/checker-answers/

    Save the checker answers where nothing is saved yet, then queue a check

    API keys can call this. Accepts an Idempotency-Key.

  • GET/obligations/declarations/

    Return declarations and revenue for the entities the caller may see

    API keys can call this.

  • PUT/obligations/declarations/

    Upsert declarations and revenue; an entity outside the caller's scope or org is a 404

    API keys can call this. Accepts an Idempotency-Key.

  • GET/obligations/determinations/

    Return the latest run's producer determinations

    API keys can call this.

  • POST/obligations/evaluate/

    Create a queued run and enqueue it; never evaluates on the request thread

    API keys can call this. Accepts an Idempotency-Key.

  • GET/obligations/results/

    Return the latest succeeded run with a page of its result rows

    API keys can call this.

  • GET/obligations/runs/{run_id}/

    Return the run; another organisation's run is a 404

    API keys can call this.

Onboarding (12)

  • PATCH/brands/{id}/

    Edit a brand; a brand in an inactive or out-of-scope entity is refused

    API keys can call this. Accepts an Idempotency-Key.

  • GET/entities/

    List the caller's legal entities and brands; a scope-restricted member sees only their own

    API keys can call this.

  • PATCH/entities/{id}/

    Edit a legal entity; reactivating one re-checks the plan's entity cap

    API keys can call this. Accepts an Idempotency-Key.

  • GET/onboarding/

    Return the checklist; a user with no organisation yet gets every step open

    API keys can call this.

  • POST/onboarding/brands/

    Create a brand; an entity in another organisation or outside the caller's scope is 404

    API keys can call this. Accepts an Idempotency-Key.

  • GET/onboarding/dismissal/

    Return ``{"dismissed": bool, "dismissed_at": ISO-8601 string or null}``

    API keys can call this.

  • PUT/onboarding/dismissal/

    Set the dismissal from ``{"dismissed": bool}`` and return the new state

    API keys can call this. Accepts an Idempotency-Key.

  • POST/onboarding/entities/

    Fill the untouched default entity or create a new one, then add the brand when given

    API keys can call this. Accepts an Idempotency-Key.

  • GET/preferences/ai-assist/

    Return the caller's AI assist override, the organisation default and the effective value

    Only a signed-in person can call this.

  • PATCH/preferences/ai-assist/

    Set the caller's override from ``{"override": true | false | null}``

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • GET/preferences/shortcuts/

    Return whether the caller's single-key keyboard shortcuts are on

    Only a signed-in person can call this.

  • PATCH/preferences/shortcuts/

    Turn the caller's single-key shortcuts on or off from ``{"character_key_shortcuts": bool}``

    Only a signed-in person can call this. Accepts an Idempotency-Key.

Reports (22)

  • GET/reports/periods/

    Return periods for the entities the caller may see, filterable by status and jurisdiction

    API keys can call this.

  • POST/reports/periods/

    Open a period; an entity outside the caller's organisation or scope is a 404

    API keys can call this. Accepts an Idempotency-Key.

  • GET/reports/periods/{period_id}/

    Return the period; another organisation's period is a 404

    API keys can call this.

  • POST/reports/periods/{period_id}/amend/

    Create the amended version; an identical result is refused as `no_changes`

    API keys can call this. Accepts an Idempotency-Key.

  • GET/reports/periods/{period_id}/approvals/

    List approval requests for the period's figures

    API keys can call this.

  • POST/reports/periods/{period_id}/approvals/

    Ask a second person to approve the figures the period would seal now

    API keys can call this. Accepts an Idempotency-Key.

  • POST/reports/periods/{period_id}/approvals/{uid}/approve/

    Approve the period's figures as the second person

    API keys can call this. Accepts an Idempotency-Key.

  • POST/reports/periods/{period_id}/approvals/{uid}/reject/

    Send the period's figures back with a note

    API keys can call this. Accepts an Idempotency-Key.

  • POST/reports/periods/{period_id}/checks/

    Store a fresh set of findings and return them

    API keys can call this. Accepts an Idempotency-Key.

  • GET/reports/periods/{period_id}/findings/

    Return the newest run per format, each with its findings

    API keys can call this.

  • POST/reports/periods/{period_id}/findings/{finding_id}/acknowledge/

    Acknowledge a warning or note with a note; blocking findings and locked periods are refused

    API keys can call this. Accepts an Idempotency-Key.

  • GET/reports/periods/{period_id}/inputs/

    Return the recorded header values

    API keys can call this.

  • PUT/reports/periods/{period_id}/inputs/

    Set or clear header values; a locked period answers 409 `record_locked`

    API keys can call this. Accepts an Idempotency-Key.

  • POST/reports/periods/{period_id}/lock/

    Seal one version per format and return them

    API keys can call this. Accepts an Idempotency-Key.

  • GET/reports/periods/{period_id}/methodology/

    Return the document as JSON (default), HTML or PDF

    API keys can call this.

  • GET/reports/second-approval/

    Return whether a second approval is required

    Only a signed-in person can call this.

  • PUT/reports/second-approval/

    Turn the second-approval requirement on or off

    Only a signed-in person can call this. Accepts an Idempotency-Key.

  • GET/reports/versions/{version_id}/

    Return the version; another organisation's version is a 404

    API keys can call this.

  • POST/reports/versions/{version_id}/attest/

    Record name, title, signature and time; needs the signing right (403 `signer_not_authorised`) and a paid plan (402)

    API keys can call this. Accepts an Idempotency-Key.

  • GET/reports/versions/{version_id}/diff/

    Return the stored diff, or 404 when this is the first version

    API keys can call this.

  • GET/reports/versions/{version_id}/file/

    Stream the prepared file and audit the export

    API keys can call this.

  • GET/reports/versions/{version_id}/methodology/

    Return the note as Markdown (default), HTML or PDF; PDF is 409 when it could not be rendered

    API keys can call this.

Small business (12)

  • GET/small-business/calendar-feed/

    Read the calendar feed state

    API keys can call this.

  • POST/small-business/calendar-feed/

    Make a new calendar link (the old one stops working)

    API keys can call this. Accepts an Idempotency-Key.

  • DELETE/small-business/calendar-feed/

    Turn the calendar link off

    API keys can call this. Accepts an Idempotency-Key.

  • GET/small-business/exemptions/

    List tracked exemption applications

    API keys can call this.

  • PATCH/small-business/exemptions/{uid}/

    Update a tracked exemption (status, deadline, filed date, reference, notes)

    API keys can call this. Accepts an Idempotency-Key.

  • DELETE/small-business/exemptions/{uid}/

    Stop tracking an exemption

    API keys can call this. Accepts an Idempotency-Key.

  • GET/small-business/free-plan/

    Read what the free plan includes

    API keys can call this.

  • GET/small-business/owner-summary/

    Read the printable owner summary

    API keys can call this.

  • GET/small-business/packaging-templates/

    List packaging templates

    API keys can call this.

  • POST/small-business/packaging-templates/apply/

    Add a packaging template's components to a product

    API keys can call this. Accepts an Idempotency-Key.

  • GET/small-business/threshold-check/

    Read the check's choices and the latest saved check

    API keys can call this.

  • POST/small-business/threshold-check/

    Run and save the threshold check

    API keys can call this. Accepts an Idempotency-Key.

Support (5)

  • POST/support/inbound/

    Verify the signature, store the event once, and thread the mail onto a ticket

    API keys can call this. Accepts an Idempotency-Key.

  • GET/support/staff/tickets/

    List tickets (`status`, `assignee` = me|unassigned|<id>, `organization`, `q`)

    API keys can call this.

  • GET/support/staff/tickets/{uid}/

    Return a ticket with every message including internal notes

    API keys can call this.

  • PATCH/support/staff/tickets/{uid}/

    Change ``status`` and/or ``assignee`` (``"me"``, a staff user id, or null to unassign)

    API keys can call this. Accepts an Idempotency-Key.

  • POST/support/staff/tickets/{uid}/reply/

    Email a reply to the requester, or save an internal note when `note` is true

    API keys can call this. Accepts an Idempotency-Key.

Targets (10)

  • POST/targets/evaluate/

    Evaluate and store the result; pending rules are named in `pending_leaves`

    API keys can call this. Accepts an Idempotency-Key.

  • GET/targets/evaluations/

    Return up to 100 saved evaluations without their result bodies

    API keys can call this.

  • GET/targets/evaluations/{id}/

    Return the run; another organisation's (or another scoped user's) run is a 404

    API keys can call this.

  • POST/targets/labelling/

    Evaluate labelling for the selected specs in the requested markets and save the run

    API keys can call this. Accepts an Idempotency-Key.

  • GET/targets/options/

    Return the caller's visible specs (with components) and the material catalogue

    API keys can call this.

  • POST/targets/simulate/

    Return deltas in fees, targets, PPWR grade and UK PPT for the proposed changes

    API keys can call this. Accepts an Idempotency-Key.

  • GET/targets/tracking/

    Return tracked targets; restricted members see only their scoped entities' targets

    API keys can call this.

  • POST/targets/tracking/

    Create a tracked target in the caller's organisation

    API keys can call this. Accepts an Idempotency-Key.

  • PATCH/targets/tracking/{id}/

    Update figures; another organisation's target is a 404

    API keys can call this. Accepts an Idempotency-Key.

  • DELETE/targets/tracking/{id}/

    Delete a tracked target

    API keys can call this. Accepts an Idempotency-Key.