API

Every paid report is one API call. Your API key is a bearer credential — keep it secret, and treat it like a password.

1. Get a key

On /pricing, get an API key. You receive it once on the key page (the raw key never rides a URL — the checkout redirect carries only a session id and the page fetches the key from POST /api/keys/reveal) and each report spends one credit.

2. Create an order

Send the two positions plus your consent to POST /api/orders with your key:

curl -H "Authorization: Bearer <your-key>" \
     -H "Content-Type: application/json" \
     -d '{
       "inputs": {
         "position_a": {"role": "employee", "salary": 50000, "expenses": 25000},
         "position_b": {"role": "contractor", "expenses": 25000},
         "horizon_years": 10,
         "input_currency": "SEK"
       },
       "consent_waiver": true
     }' \
     https://your-domain.example/api/orders

→ {"token": "..."}. One credit is spent atomically; a missing or bad key is a 401, a key with no credits left is a 402, and invalid inputs are a 422 before any credit is spent.

3. Poll the order

curl https://your-domain.example/api/orders/<token>/status

→ {"status": "paid"} then "generating" then "generated"; a failed run reports "failed" and the credit is refunded.

4. Download the report once

curl https://your-domain.example/api/download/<token>

The self-contained HTML report downloads exactly once, any time within the 30-day retention window (a lost artifact is regenerated automatically; a paid-but-never-activated pack is healed by the daily reconciliation job or refunded automatically — no support ticket needed).

5. Resend a link (self-service)

curl -X POST https://your-domain.example/api/resend/<token>

→ {"token": "<fresh-token>"}. Token-holders can mint a fresh one-time link for a delivered/generated order.

Balance

curl -H "Content-Type: application/json" \
     -d '{"key": "<your-key>"}' \
     https://your-domain.example/api/keys/status

→ {"active": true, "credits": 19}.

Notes