# Admin Center API

URL: /en/docs/api
Last Updated: 2026-07-30T21:15:44.006Z

## Description
Complete REST API reference for building and managing powerful white-label trust centers

## Available Actions
- Navigate to related topics
- View step-by-step instructions
- Get best practices

## Content
import { Code, Users, FileText, ShieldCheck, Globe, Key } from "lucide-react";

# Trust Center Admin API

Build powerful white-label trust center with our comprehensive REST API. The Trust Center Admin API enables you to programmatically manage customer accounts, documents, certifications, access requests, and branded trust center configurations at enterprise scale.

## What You Can Build

<Cards>
  <Card title="Automated Onboarding" icon={<Users />}>
    Create customer accounts, invite contacts, and provision document access
    through automated workflows and integrations.
  </Card>

  <Card title="Document Workflows" icon={<FileText />}>
    Upload compliance documents, manage access levels, handle access requests,
    and automate approval processes.
  </Card>

  <Card title="Compliance Automation" icon={<ShieldCheck />}>
    Track certifications, manage NDA workflows, automate access approvals, and
    maintain compliance audit trails.
  </Card>

  <Card title="White-Label Trust Centers" icon={<Globe />}>
    Configure branded trust centers, manage deployment domains, and customize
    the complete customer experience.
  </Card>
</Cards>

## Why Choose Our API

### 🚀 **REST-First Design**

Built following industry best practices from Stripe, GitHub, and Notion. Clean HTTP endpoints, predictable resource patterns, and comprehensive error handling designed for seamless integration.

### 🔒 **Enterprise Security**

API key authentication, role-based access control, tenant isolation, and comprehensive audit logging. Designed for enterprise compliance requirements.

### ⚡ **Production Ready**

Rate limiting, automated notifications, and 99.5% uptime SLA. Scale from prototype to enterprise without architectural changes.

## Getting Started

### 1. Authentication

The Admin Center API uses API keys for programmatic access. Browser login is available only through the Admin Center UI and does not issue API bearer tokens.

Create an API key from **Admin Center → Integrations → API Keys**, store it securely, and pass it as a bearer token:

```bash
Authorization: Bearer $TRUST_CENTER_API_KEY
```

**Use API keys for:**

* Production server-to-server integrations
* Automated compliance workflows
* Long-running background processes
* CI/CD pipelines and deployment scripts

### 2. Your First API Call

Test your setup by listing customer accounts in your tenant:

```bash
curl -H "Authorization: Bearer $TRUST_CENTER_API_KEY" \
  -H "Content-Type: application/json" \
  https://app.orbiqhq.com/api/v1/accounts
```

```javascript
const response = await fetch("https://app.orbiqhq.com/api/v1/accounts", {
  headers: {
    Authorization: "Bearer " + apiKey,
    "Content-Type": "application/json",
  },
});

const { accounts } = await response.json();
console.log(`Managing ${accounts.length} customer accounts`);
```

### 3. Explore the Documentation

<Cards>
  <Card title="API v1 Reference" href="/en/docs/api/v1" icon={<Code />}>
    Complete endpoint documentation with HTTP examples and schemas
  </Card>

  <Card title="Authentication Guide" href="/en/docs/api/v1" icon={<Key />}>
    Learn about JWT tokens, session management, and security best practices
  </Card>
</Cards>

## API Capabilities Overview

### **Core Resource Management**

* **Accounts** - Manage customer organizations, contacts, and compliance workflows
* **Users** - Handle user invitations, roles, and profile management
* **Documents** - Upload, categorize, and control access to compliance documents
* **Certifications** - Manage certificates with validity tracking and automated renewals
* **Frequently Asked Questions** - Manage Q\&A content for making your trust center more understandable
* **Knowledge Base** - Manage Q\&A content for customer self-service search

### **Workflow Automation**

* **Access Requests** - Handle trust center visitor requests and automated approvals
* **Notifications** - Send/Receive template-based emails, webhooks or Slack/Teams messages for onboarding and approvals
* **Analytics Tracking** - Monitor user interactions and system usage patterns
* **Brand Management** - Configure white-label themes and deployment settings

### **Enterprise Administration**

* **API Key Management** - Generate and manage programmatic access credentials

## Enterprise Features

### **White-Label Capabilities**

* Custom domain deployment (trust.yourcompany.com) - Available in non-free plans
* Complete brand customization (logos, colors, fonts)
* No trace of Orbiq in customer-facing interfaces
* Multi-language support (EN/DE/FR)

### **Compliance & Security**

* SOC 2 Type II certified infrastructure
* GDPR and data residency compliance
* Comprehensive audit logs for all operations
* Role-based access control with tenant isolation

### **Scale & Performance**

* European CDN for global file delivery
* Auto-scaling infrastructure
* Sub-200ms API response times (p95)
* 99.9% uptime SLA with real-time status monitoring

## Real-World Integration Examples

### **Automated Customer Onboarding**

```bash
# 1. Create customer account with contacts
curl -X POST "https://app.orbiqhq.com/api/v1/accounts" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Acme Europe",
    "description": "Fictional company compliance management",
    "contacts": [
      {
        "email": "compliance@acme.example",
        "first_name": "Jane",
        "last_name": "Smith",
        "title": "Compliance Manager"
      }
    ]
  }'

# 2. Share relevant compliance documents
curl -X PATCH "https://app.orbiqhq.com/api/v1/accounts/acc_123/documents" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "document_ids": ["doc_privacy_policy", "doc_security_audit"],
    "access_level": "restricted"
  }'
```

### **Access Request Approval Workflow**

```bash
# 1. List pending access requests
curl -H "Authorization: Bearer $TOKEN" \
  "https://app.orbiqhq.com/api/v1/access-requests?review_status=to_review"

# 2. Approve access request (triggers automatic email)
curl -X PATCH "https://app.orbiqhq.com/api/v1/access-requests/req_123" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"review_status": "approved"}'
```

### **Brand Configuration for White-Label Trust Centers**

```bash
# Configure trust center appearance
curl -X PATCH "https://app.orbiqhq.com/api/v1/brand" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Acme Trust Center",
    "primary_color": "#0066cc",
    "deployment_domains": "trust.acme.com,trust.acme.de",
    "footer_text": "© 2025 Acme. All rights reserved."
  }'

# Upload custom logo
curl -X PUT "https://app.orbiqhq.com/api/v1/brand/logo" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: multipart/form-data" \
  -F "file=@/path/to/company-logo.png"
```

### **Document Management Integration**

```bash
# 1. Create document metadata
curl -X POST "https://app.orbiqhq.com/api/v1/documents" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "SOC 2 Type II Report",
    "description": "Annual security audit report",
    "access_level": "requires_nda",
    "category": "security-audits",
    "featured": true
  }'

# 2. Upload document file
curl -X PUT "https://app.orbiqhq.com/api/v1/documents/doc_123/file" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/pdf" \
  --data-binary @soc2-report.pdf
```

## HTTP Status Codes & Error Handling

### Standard Response Codes

| Code  | Meaning           | Usage                                           |
| ----- | ----------------- | ----------------------------------------------- |
| `200` | OK                | Successful GET/PATCH operations                 |
| `201` | Created           | Successful POST operations                      |
| `204` | No Content        | Successful DELETE operations                    |
| `400` | Bad Request       | Invalid request parameters or validation errors |
| `401` | Unauthorized      | Missing or invalid authentication token         |
| `403` | Forbidden         | Insufficient permissions for the operation      |
| `404` | Not Found         | Requested resource does not exist               |
| `409` | Conflict          | Resource conflict (e.g., duplicate email)       |
| `429` | Too Many Requests | Rate limit exceeded                             |
| `500` | Server Error      | Unexpected server error                         |

### Error Response Format

```json
{
  "error": {
    "type": "validation_error",
    "message": "Invalid email address format",
    "param": "email"
  }
}
```

## Rate Limits & Best Practices

* **Rate Limit**: 1000 requests per minute per authentication token
* **Bulk Operations**: Use bulk endpoints for managing multiple resources
* **Error Handling**: Implement exponential backoff for rate limit and server errors

## Integration Patterns

### **Webhook Notifications**

Set up real-time notifications for account events, document uploads, and access request status changes.

### **Batch Processing**

Use bulk endpoints for processing large datasets efficiently.

### **Multi-Tenant Architecture**

Each API token is automatically scoped to your tenant - no need to specify tenant IDs in requests.

***

Ready to get started? Head to the [API v1 Reference](/en/docs/api/v1) for detailed endpoint documentation and HTTP examples.


## Code Examples Found
- bash: Authorization: Bearer $TRUST_CENTER_API_KEY...
- bash: curl -H "Authorization: Bearer $TRUST_CENTER_API_KEY" \
  -H "Content-Type: application/json" \
  ht...
- javascript: const response = await fetch("https://app.orbiqhq.com/api/v1/accounts", {
  headers: {
    Authoriza...
- bash: # 1. Create customer account with contacts
curl -X POST "https://app.orbiqhq.com/api/v1/accounts" \
...
- bash: # 1. List pending access requests
curl -H "Authorization: Bearer $TOKEN" \
  "https://app.orbiqhq.co...
- bash: # Configure trust center appearance
curl -X PATCH "https://app.orbiqhq.com/api/v1/brand" \
  -H "Aut...
- bash: # 1. Create document metadata
curl -X POST "https://app.orbiqhq.com/api/v1/documents" \
  -H "Author...
- json: {
  "error": {
    "type": "validation_error",
    "message": "Invalid email address format",
    "p...