# OpenAPI & Postman

The API's contract as a file: the live OpenAPI document, and a Postman collection of the routes these pages document, generated from it every time the docs are published.

## Overview

- [Download OpenAPI](https://api.aureahub.com/v1/docs/json) — The live document (JSON, OpenAPI 3.1), as the running API serves it.
- Download Postman collection — Postman v2.1, one folder per area, with the authentication already set.

## The OpenAPI Document

- [`https://api.aureahub.com/v1/docs/json`](https://api.aureahub.com/v1/docs/json) — JSON; [YAML](https://api.aureahub.com/v1/docs/yaml). It is always what the running version answers ([Versioning](https://docs.aureahub.com/docs/versioning.md)).
- For TypeScript and JavaScript, [`@aureahub/sdk`](https://docs.aureahub.com/docs/sdk.md) is generated from it, for the routes these pages document.
- Generate a client from it with any OpenAPI 3.1 generator, or give it to an agent with [`llms-full.txt`](https://docs.aureahub.com/llms-full.txt) ([Overview › Machine-Readable](https://docs.aureahub.com/docs/introduction.md)).
- The document lists more routes than these pages: integrate only the routes documented here. A route that is not in these pages is not part of your integration, and may answer `403` or `404` for your tenant.

## The Postman Collection

1. Download `aurea-api.postman_collection.json` and import it in Postman (**Import** › the file).
2. In the collection's **Variables**, set `accessToken` to a user's access token ([Login](https://docs.aureahub.com/docs/auth-login.md)), and — for the calls your server signs — `tenantApiKey` and `tenantApiSecret`. `baseUrl` is `https://api.aureahub.com`.
3. Keep `isTestnet` `true` in the requests you try: the collection is for testing ([Environments › Test and Live](https://docs.aureahub.com/docs/guide-environments.md)).

- It holds the routes these pages document — the same ones, generated from the live document when the docs are published — with each route's path, query and headers, and an example body built from its schema. The pages say what each field means.
- Store `tenantApiSecret` as a secret variable in a private workspace only, and never share or export a collection that holds it.

## Signing in Postman

The routes your server signs ([Authentication › HMAC Request Signing](https://docs.aureahub.com/docs/authentication.md)) carry `x-tenant-api-key`, `x-timestamp` and `x-signature`. The collection's pre-request script fills them in from `tenantApiKey` and `tenantApiSecret` for those routes, as your server does: `x-signature` = hex HMAC-SHA256 of `METHOD\nPATH?QUERY\nTIMESTAMP\nSHA256(BODY)`. A signature is accepted once: send the request again and it is signed again.

---

Web version: https://docs.aureahub.com/#api-downloads