API reference · Pricing, reporting & reconciliation

Reconciling entity credentials

POST/reconciliation/entity/{code}/keyRegister a key for a reconciling entity
GET/reconciliation/entity/{code}/keysList an entity's keys

POST Register a key for a reconciling entity

POST /reconciliation/entity/{code}/key

For a signed file Bridge stores only the entity's public key and cannot sign on its behalf even in principle - which is the strongest reason to prefer the file channel. For a webhook Bridge must hold the shared secret, so it is minted here, encrypted at rest and returned exactly once; it cannot be read back afterwards. Registering a second key of the same purpose rotates: the previous signing key moves to verify-only and goes on verifying the files it already signed, because a reconciliation whose evidence expires when a key rotates is not evidence.

Headers

Name	Notes
`Authorization`	Bearer token
`X-Tenant`	Your tenant
`X-Environment`	test or live
`Content-Type`	application/json

Path parameters

Name
`code`

Example

Request body: RegisterKeyRequest · Response: GenericResponseKeyResponse

curl -X POST "https://api.bridgemoni.com/reconciliation/entity/value/key" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV" \
  -H "Content-Type: application/json" \
  -d '{
  "keyId": "string",
  "purpose": "string",
  "algorithm": "string",
  "publicKey": "string",
  "notBefore": "string",
  "notAfter": "string"
}'

{
  "keyId": "string",
  "purpose": "string",
  "algorithm": "string",
  "publicKey": "string",
  "notBefore": "string",
  "notAfter": "string"
}

{
  "data": {
    "reference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
    "entityCode": "string",
    "keyId": "string",
    "purpose": "string",
    "algorithm": "string",
    "fingerprint": "string",
    "status": "string",
    "notBefore": "string",
    "notAfter": "string",
    "retiredAt": "string",
    "revokedAt": "string",
    "supersededKeyId": "string",
    "sharedSecret": "string"
  },
  "description": "Key registered successfully"
}

Responses

Status	When
`200`	Key registered successfully

GET List an entity's keys

GET /reconciliation/entity/{code}/keys

Every key the entity has ever had, with the state each is in. Secrets are never returned - only the fingerprint, which is enough to tell two keys apart and useless for signing anything.

Headers

Name	Notes
`Authorization`	Bearer token
`X-Tenant`	Your tenant
`X-Environment`	test or live

Path parameters

Name
`code`

Example

Response: GenericResponseListKeyResponse

curl -X GET "https://api.bridgemoni.com/reconciliation/entity/value/keys" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV"

{
  "data": [
    {
      "reference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
      "entityCode": "string",
      "keyId": "string",
      "purpose": "string",
      "algorithm": "string",
      "fingerprint": "string",
      "status": "string",
      "notBefore": "string",
      "notAfter": "string",
      "retiredAt": "string",
      "revokedAt": "string",
      "supersededKeyId": "string",
      "sharedSecret": "string"
    }
  ],
  "description": "Keys retrieved successfully"
}

Responses

Status	When
`200`	Keys retrieved successfully

Generated from the OpenAPI document. Branch on the HTTP status: there is no machine-readable error code on the wire. Errors