Company logoTrust Center Documentation

API v1 Reference

Complete REST API reference for Trust Center Admin API v1 with interactive examples and comprehensive endpoint documentation

API v1 Reference

The Trust Center Admin API v1 provides complete programmatic access to manage customer accounts, documents, certifications, access requests, and white-label trust center configurations. Built with REST principles and designed for enterprise-scale integrations.

Quick Start

Authentication

The Admin Center API uses API keys for programmatic access. Browser login is available only through the Admin Center UI and does not issue API bearer tokens.

Create an API key from Admin Center → Integrations → API Keys, store it securely, and pass it as a bearer API key:

API Key Benefits:

  • Long-lasting authentication (up to 365 days)
  • Role-based permissions (admin, account_manager, content_manager, viewer)
  • Perfect for server-to-server integrations
  • One-time key display for enhanced security

Authorization header format:

Authorization: Bearer $TRUST_CENTER_API_KEY

Base URL

All API endpoints are relative to the admin center domain:

https://app.orbiqhq.com/api/v1/

Your First Request

Test your authentication by listing customer accounts:

curl -H "Authorization: Bearer $TRUST_CENTER_API_KEY" \
  -H "Content-Type: application/json" \
  https://app.orbiqhq.com/api/v1/accounts

All Endpoints

Every operation in the v1 API, grouped by resource. This list is generated from the OpenAPI specifications, so it stays complete as endpoints are added.

Access Requests

Accounts

Activity

Analytics

Ask

Authentication

Brand

Certifications

Contacts

Custom Fields

Documents

Feedback

Imports

Integrations

Knowledge Base

NDA Acceptances

NDA Templates

Settings

Subprocessors

Tabs

Trusted By

Update Classifications

Update Templates

Updates

Users

Variants

Response Format

All API responses follow a consistent structure:

Success Response (Single Resource)

{
  "success": true,
  "data": {
    "account": {
      "id": "550e8400-e29b-41d4-a716-446655440000",
      "title": "Acme Corp",
      "review_status": "completed"
    }
  }
}

Collection Response

{
  "accounts": [
    {
      "id": "550e8400-e29b-41d4-a716-446655440000",
      "title": "Acme Corp",
      "review_status": "completed"
    }
  ]
}

Error Response

{
  "error": {
    "type": "validation_error",
    "message": "The email address provided is not valid",
    "param": "email"
  }
}

HTTP Status Codes

CodeMeaningDescription
200OKRequest successful
201CreatedResource created successfully
204No ContentSuccessful deletion or update with no response body
400Bad RequestInvalid request parameters
401UnauthorizedAuthentication required
403ForbiddenInsufficient permissions
404Not FoundResource not found
409ConflictResource conflict (e.g., duplicate email)
422Unprocessable EntityValid syntax but semantic errors
429Too Many RequestsRate limit exceeded
500Server ErrorServer error

Pagination

List endpoints support cursor-based pagination:

# Get first page
curl -H "Authorization: Bearer $TRUST_CENTER_API_KEY" \
  "https://app.orbiqhq.com/api/v1/accounts?limit=50"

# Get next page using cursor
curl -H "Authorization: Bearer $TRUST_CENTER_API_KEY" \
  "https://app.orbiqhq.com/api/v1/accounts?limit=50&starting_after=acc_123"

Query Parameters:

  • limit - Number of items to return (max 100, default 20)
  • starting_after - Cursor for pagination
  • ending_before - Reverse pagination cursor

Rate Limiting

  • Limit: 1000 requests per minute per API key
  • Headers: Rate limit info included in response headers
  • 429 Response: Includes Retry-After header with seconds to wait
X-RateLimit-Limit: 1000
X-RateLimit-Remaining: 999
X-RateLimit-Reset: 1640995200

Common Integration Patterns

Error Handling

async function createAccount(accountData) {
  try {
    const response = await fetch("https://app.orbiqhq.com/api/v1/accounts", {
      method: "POST",
      headers: {
        Authorization: "Bearer " + apiKey,
        "Content-Type": "application/json",
      },
      body: JSON.stringify(accountData),
    });

    if (!response.ok) {
      const error = await response.json();
      throw new Error(`API Error: ${error.error.message}`);
    }

    return await response.json();
  } catch (error) {
    console.error("Failed to create account:", error.message);
    throw error;
  }
}

Document Upload Workflow

# 1. Create document metadata. `title`, `category` and `access_level` are
#    required, and `category` is a category UUID rather than its name.
RESPONSE=$(curl -X POST "https://app.orbiqhq.com/api/v1/documents" \
  -H "Authorization: Bearer $TRUST_CENTER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Privacy Policy",
    "category": "550e8400-e29b-41d4-a716-446655440000",
    "access_level": "public",
    "featured": { "control": false, "resource": true }
  }')

DOCUMENT_ID=$(echo $RESPONSE | jq -r '.data.document.id')

# 2. Upload the file. Multipart is simpler; this binary form needs the
#    original filename header so the stored file keeps its name.
curl -X PUT "https://app.orbiqhq.com/api/v1/documents/$DOCUMENT_ID/file" \
  -H "Authorization: Bearer $TRUST_CENTER_API_KEY" \
  -H "X-Original-Filename: privacy-policy.pdf" \
  --data-binary @privacy-policy.pdf

Access Request Approval Automation

import requests

api_key = "YOUR_TRUST_CENTER_API_KEY"

def approve_pending_requests():
    # Get all pending requests
    response = requests.get(
        "https://app.orbiqhq.com/api/v1/access-requests",
        params={"review_status": "to_review"},
        headers={"Authorization": f"Bearer {api_key}"}
    )

    pending_requests = response.json()["contacts"]

    # Auto-approve requests from verified domains
    for request in pending_requests:
        if request["email"].endswith("@trustedcompany.com"):
            requests.patch(
                f"https://app.orbiqhq.com/api/v1/access-requests/{request['id']}",
                json={"review_status": "approved"},
                headers={"Authorization": f"Bearer {api_key}"}
            )
            print(f"Auto-approved: {request['email']}")

White-Label Configuration

# Update trust center branding
curl -X PATCH "https://app.orbiqhq.com/api/v1/brand" \
  -H "Authorization: Bearer $TRUST_CENTER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Acme Trust Center",
    "primary_color": "#0066cc",
    "deployment_domains": "trust.acme.com",
    "footer_text": "© 2025 Acme. All rights reserved."
  }'

# Upload custom logo
curl -X PUT "https://app.orbiqhq.com/api/v1/brand/logo" \
  -H "Authorization: Bearer $TRUST_CENTER_API_KEY" \
  -H "Content-Type: multipart/form-data" \
  -F "file=@/path/to/company-logo.png"

Development Tools

Testing Your Integration

Use these endpoints to verify your setup:

# Health check
curl -H "Authorization: Bearer $TRUST_CENTER_API_KEY" \
  https://app.orbiqhq.com/api/v1/accounts

# Test creating a document
curl -X POST "https://app.orbiqhq.com/api/v1/documents" \
  -H "Authorization: Bearer $TRUST_CENTER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"title": "Test Document", "category": "550e8400-e29b-41d4-a716-446655440000", "access_level": "public"}'

Webhook Integration

Set up webhooks to receive real-time notifications:

  • Account status changes
  • Document uploads and approvals
  • Access request submissions
  • Certification expiry alerts

Bulk Operations

For large-scale operations, use filtering and pagination:

# Process all accounts needing review
curl -H "Authorization: Bearer $TRUST_CENTER_API_KEY" \
  "https://app.orbiqhq.com/api/v1/accounts?status=in_review&limit=100"

# Bulk approve access requests
curl -H "Authorization: Bearer $TRUST_CENTER_API_KEY" \
  "https://app.orbiqhq.com/api/v1/access-requests?review_status=to_review&account_id=acc_123"

Next Steps

Authentication Deep Dive

Learn about API keys, session management, and security best practices

Webhook Integration

Set up real-time notifications for account and document events

Integration Examples

Explore sample implementations and integration patterns

Postman Collection

Download our Postman collection for easy API testing

Ready to dive deeper? Browse the complete endpoint documentation above or start with account management to get familiar with the API patterns.

How is this guide?

Ask the documentation assistant POST

Previous Page

Accept an invitation using token and password POST

Next Page

On this page

API v1 ReferenceQuick StartAuthenticationBase URLYour First RequestAll EndpointsAccess RequestsAccountsActivityAnalyticsAskAuthenticationBrandCertificationsContactsCustom FieldsDocumentsFeedbackImportsIntegrationsKnowledge BaseNDA AcceptancesNDA TemplatesSettingsSubprocessorsTabsTrusted ByUpdate ClassificationsUpdate TemplatesUpdatesUsersVariantsResponse FormatSuccess Response (Single Resource)Collection ResponseError ResponseHTTP Status CodesPaginationRate LimitingCommon Integration PatternsError HandlingDocument Upload WorkflowAccess Request Approval AutomationWhite-Label ConfigurationDevelopment ToolsTesting Your IntegrationWebhook IntegrationBulk OperationsNext Steps