API
API overview
Base URL, versioning, request format, endpoints and conventions for the Arrota REST API.
Updated
On this page
The Arrota API is a JSON REST API for issuing and listing digital credentials and for running verification requests.
Base URL
https://app.arrota.com/api/v1Versioning
The version is part of the path (/api/v1). Every response carries an X-API-Version: 1 header. Responses are sent with Cache-Control: no-store.
Requests and responses
- Send JSON request bodies with
Content-Type: application/json. - Responses are JSON. Successful responses carry the resource data; errors carry an
errormessage. See Errors. - Authenticate every request with a Bearer API key. See Authentication.
Endpoints
| Method | Path | Scope | Purpose |
|---|---|---|---|
| GET | /api/v1/credentials | credentials:read | List credentials your organisation issued |
| POST | /api/v1/credentials | credentials:write | Issue a credential |
| POST | /api/v1/verifications | verifications:write | Submit a verification request |
| GET | /api/v1/verifications/{id} | verifications:write | Get a verification request |
Two public endpoints need no key: Open Badges 3.0 JSON for credentials a holder has published, and the issuer public key directory for checking credential signatures yourself.
Conventions
- Pagination: credential lists use cursors. See Pagination.
- Idempotency: retrying an identical issuance returns the original credential. See Idempotency.
- Rate limits: limits apply per API key and are reported in response headers. See Rate limits.
- Dates: request dates use
YYYY-MM-DD. Timestamps in responses are ISO 8601 in UTC.
What the API does not include
- No SDK. Use any HTTP client; the examples in these docs use
curlandfetch. - No sandbox or test mode, and no OAuth. Keys act on your live organisation.
- No endpoints to revoke or correct credentials, or to manage keys and webhooks. Do these in the issuer dashboard.
- No access to holders' personal data or to skills and workforce insights.