API Overview

TrustComponent exposes a small, stable public REST API across its products. Today it covers fetching CAPTCHA results, pushing monitoring heartbeats, validating VAT IDs and reading the audit log — everything else happens in the dashboard.

https://api.trustcomponent.com

Each product namespaces its endpoints under the base URL:

Responses carry an X-API-Version header (e.g. captcha/v2) identifying the API version that served them.

Most endpoints authenticate with an API key, sent as a bearer token:

Authorization: Bearer ak_your_key_here

• Keys are prefixed ak_ and belong to a project or an agency.
• Project keys work for every module of their project and for the project’s audit log. Create them under Settings › API Keys & Webhooks in the project.
• Agency keys read the agency’s own audit log. Create them under Settings › API Keys in the agency.
• A key is shown in full only once, at creation — we store only a hash. Keys can carry an expiry date.
• A key only works against the resources of its own project or agency.

Two endpoints use URL tokens instead of a key, so they work from a bare curl in a cron line or an email link: heartbeat pings (per-monitor hbt_… token) and alert acknowledgement (signed one-time token). See Monitoring.

• IDs are UUIDs.
• Timestamps are ISO-8601 in UTC (e.g. 2026-07-01T10:30:00Z).
• Content type is application/json for request and response bodies unless stated otherwise.
• Errors use standard HTTP status codes: 401 (missing credentials), 403 (invalid credentials or not permitted), 402 (the project is locked, or its plan does not include the feature), 404 (not found), 422 (invalid input). Each product page lists the codes specific to its endpoints.