API reference
Update allowed settings
Updates one allowed organization settings category and records its configuration version and audit history.
https://api.sparkglim.net/api/white-label/v1/settings/:categoryAccess model
- Access model
- Server-side Organization HMAC
- Required scope
settings:write- Documented availability
- Implemented in source
Availability is verified from source, not a live production guarantee.
Private signing stays on your server. API Version 1 uses signature format v2; it is not API v2.
Headers
| Name | Type | Validation |
|---|---|---|
x-white-label-domainRequiredVerified website hostname used to resolve the approved organization account and bind this request. | string | Validation: verified HTTPS hostname. |
x-white-label-key-idRequiredIdentifier extracted from the single issued Private Key value; never send its secret in this header. | string | Validation: issued private key internal identifier. |
x-white-label-signature-versionRequiredSelects the domain-bound signing format; API routes remain Version 1. | string | Validation: 2. |
x-white-label-timestampRequiredRequest signing time in milliseconds, checked against the server clock to reject stale requests. | string | Validation: 13 digit milliseconds; within five minutes. |
x-white-label-nonceRequiredFresh random signing value recorded by the server to reject replay of a signed request. | string | Validation: fresh 16–128 [A-Za-z0-9_-]. |
x-white-label-signatureRequiredHMAC-SHA256 of the canonical domain, idempotency key, campaign credential, timestamp, nonce, method, path, sorted query and exact body hash. | string | Validation: lowercase hexadecimal HMAC-SHA256. |
x-white-label-campaign-keyOptionalOptional complete Campaign Key that narrows a private request to the same authorized campaign. | string | Validation: complete optional scoped keyId:secret. |
Parameters
| Name | Type | Validation |
|---|---|---|
categoryRequiredConfigured campaign category or approved settings category, depending on the resource. | string | Validation: UUID or documented resource identifier. |
Request
| Name | Type | Validation |
|---|---|---|
configRequiredAllowed settings payload for the specified category; protected operational policy is still enforced. | object | Validation: allowed settings object. |
Request
Examples describe the contract and are not executed. Use authorized test records; never paste a real secret into these pages.
PATCH /api/white-label/v1/settings/branding HTTP/1.1
Host: api.sparkglim.net
x-white-label-domain: events.example.com
x-white-label-key-id: <ISSUED_KEY_ID>
x-white-label-signature-version: 2
x-white-label-timestamp: <FRESH_MILLISECONDS>
x-white-label-nonce: <FRESH_SIGNING_NONCE>
x-white-label-signature: <SERVER_GENERATED_SIGNATURE>
Content-Type: application/json
{
"config": {
"platformName": "Example organization"
}
}Response
{
"success": true,
"data": {
"category": "branding",
"config": {
"platformName": "Example organization"
}
},
"requestId": "wlapi_example"
}{
"success": false,
"error": "<ERROR_MESSAGE>",
"requestId": "wlapi_example"
}Validation, permissions, unavailable records and temporary service failures use the handler’s HTTP status and error payload.
Limits & retries
Organization limiter: 120 requests per key and 300 per IP per window; honor Retry-After and X-RateLimit headers.
Source compatibility
Authorized operations require account-specific testing.
server/src/api/router.tsserver/src/api/routes/white-label.tsserver/src/white-label/auth.tsserver/src/white-label/schemas.tsserver/src/white-label/organization-service.tsserver/src/white-label/service.ts