API, webhooks and MCP

REST API

The API lives under /api/v1/epr/. Authenticate with a key in the Authorization header as Bearer, using ik_live_ keys for real data and ik_test_ keys for the sandbox, or with an OAuth access token. The current API version is 2026-10-01.

The OpenAPI document is served at /api/v1/epr/openapi.json, signed out or with a key. The full API reference, with every operation and error code, is at /docs/api.

Scopes

Keys are scoped and expiring, stored hashed and shown once. Scopes: catalog:read, catalog:write, measurements:propose, volumes:write, suppliers:write, imports:write, reports:prepare, reports:read, fees:read, obligations:read, audit:read, webhooks:manage and files:manage.

There is no scope to confirm a measurement, sign a report or change security settings. Those stay with people.

Webhooks

Each delivery is a signed POST. The Instica-Signature header has a timestamp t and one or more v1 values, each an HMAC-SHA256 of the timestamp, a dot and the raw body, keyed with your endpoint secret (prefix whsec_). Reject a delivery whose timestamp is more than 5 minutes old.

Failed deliveries are retried with growing delays for up to 3 days. Secrets can be rotated with a 24-hour overlap, and an account can have up to 20 endpoints.

• product.created, product.updated, product.deleted, component.updated
• measurement.proposed, measurement.confirmed, measurement.superseded, measurement.voided
• supplier.updated, volume.updated, import.completed, sync.failed
• file_flow.run.succeeded, file_flow.run.failed, file_flow.run.paused
• regulation.changed, deadline.approaching, quality.flag_raised, report.prepared
• billing.invoice_created, billing.payment_failed, billing.plan_changed
• audit.event_recorded, a security stream for a SIEM that a * subscription leaves out; subscribe to it by name

MCP

A remote MCP server with OAuth lets an assistant such as Claude or Cursor work with the same data and the same scopes. Reading, proposing measurements and preparing reports go through it. Confirming, signing and changing security settings are human-only and are refused.