The Partner API

Third parties (vendors, integration partners, civic-tech developers) can do business with the platform programmatically. Two halves: a self-service developer portal inside the dashboard, and the public API documentation.

…/dashboard/developer-portal

civq.us/api/partner/v1/docs

1. Auth — long-lived API keys (shown once, hashed at rest) or OAuth2 client-credentials. Both are tenant-bound and scope-bound.
2. Scopes — least-privilege per module + action (e.g. service_requests:read, permits:write).
3. Webhooks — partners subscribe to events; deliveries are signed (HMAC) and retried, with a delivery log.
4. Limits — per-key rate limits and quotas; tenant isolation is enforced on every call.