API reference
Authentication
API keys, scopes, IP allow-lists, sessions, MFA and who can call what.
Every request needs one of two credentials. If both are sent the API key wins.
API keys
Send the key as a Bearer token. X-API-Key: <key> is accepted as an alternative header.
curl https://api.metrixed.com/v1/partners -H "Authorization: Bearer $DT_API_KEY"
Keys are created in Settings, API keys or with POST /auth/api-keys (see auth operations). The secret is shown once; only its SHA-256 hash is stored. A key has:
| Property | Meaning |
|---|---|
scopes | What it may do (below). Immutable after creation: rotate to change. |
ip_allowlist | CIDRs allowed to use the key. Other addresses get 403 forbidden. |
rate_limit_per_minute | Optional token bucket, see rate limits. |
expires_at | Optional expiry. |
principal_type | employee, system, app, partner or advertiser. Partner and advertiser keys see only their own data through the portal endpoints. |
Scopes
| Scope | Allows |
|---|---|
* | Everything the creator could do. Only creatable by a user who has full access. |
read | Every GET. |
<resource>:read, <resource>:write, <resource>:* | Reads, writes or both on one resource such as offers, partners, reports, billing, fraud, calls. |
action:<name> | A named action such as approving a payout run, when the creator may perform it. |
You can never grant a scope beyond your own permissions. A call outside the key's scopes returns 403 forbidden.
Session cookie
The portals log in with POST /auth/login (email, password, optional tenant_slug) and receive an HTTP-only dtk_session cookie. Sessions expire, can have an idle timeout set by the tenant, and are revoked on logout or password reset. Accounts lock after repeated failures (423 account_locked). Tenants may require MFA: a user without a second factor can only reach self-service enrolment (403 mfa_enrollment_required). TOTP with backup codes is supported, as are SAML and OIDC single sign-on; when SSO is enforced for a domain, password login answers 403 sso_required.
Roles and permissions
Session users act with their role's permission matrix (resource by read or write). The matrix is visible at GET /me/permissions. Built-in roles are provided and tenants can define their own. Some changes need a second person (403 maker_checker).
Public endpoints
A few operations are intentionally unauthenticated and are marked "none (public endpoint)" in the reference: the tenant branding lookup, signed communication links, public lead forms and the public status page. Provider webhooks (payouts, calls) authenticate by signature instead (401 invalid_signature).
Tracking endpoints
Click, postback and pixel URLs are not part of this API and use their own protections: security tokens, HMAC signatures and IP allow-lists per advertiser. See postbacks.