Skip to main content
The API uses the OAuth2 client credentials flow. You exchange a client_id and client_secret for a short-lived access token, then send that token — along with an organisation context header — on every request.

​
Getting Credentials

As part of the beta program you receive a client_id and client_secret, along with the IDs (org_...) of the organisations you’re authorized to access.

​
Getting an Access Token

Exchange your credentials for an access token at the token endpoint, using HTTP Basic auth (client_id as username, client_secret as password) and the com.cula.tracking audience:
Token request
Token response
Tokens are short-lived and expire after expires_in seconds. Request a new token before the current one expires or when a request returns 401.
Prefer an OAuth2 client library for your stack that supports the client credentials grant and handles token caching and renewal, rather than rolling the token exchange by hand.

​
Making Authenticated Requests

Every request needs the access token as a bearer token. Most endpoints also require a Cula-Organisation-Id header naming the organisation the request operates on:
Request headers
The organisation must be one your credentials are authorized for, otherwise the request is rejected.
The /webhooks endpoints are account-wide and do not take a Cula-Organisation-Id header. All other endpoints require it.