Skip to main content
Authenticate every request with an Authorization: Bearer credential issued by Tera staff. Canonical credential syntax uses an underscore separator only:

​
Test versus live keys

Sandbox is available now. Production is not yet available: there is no READY production API deployment and production traffic is disabled. Effective permission is account ∩ credential ∩ environment. A test key on the production host, or a live key on the sandbox host, is rejected. Do not send an environment field on a production create body to redirect the data plane.

​
Scopes

A credential may include one or more of:
  • supplier_submissions:create:basic
  • supplier_submissions:create:application
  • supplier_submissions:read
  • supplier_submissions:correct
  • supplier_submissions:promote
Unauthorised level or missing scope returns 403 and creates no row. A basic-only credential cannot create an application-level submission.

​
Secret handling

  • The secret is shown once when staff issue or rotate the key.
  • Store it in your secret manager. Tera cannot recover plaintext.
  • Send only the Authorization header. Do not put the secret in query strings or bodies.
  • After rotation, revoke the previous credential. See Key rotation.

​
Request IDs

You may send X-Request-Id. Tera always returns X-Request-Id on the response. That header is the canonical correlation identifier. Quote it with submission_id and external_reference when you contact support.