Connect your application

Use this API to add and read your organisation’s licences, request temporary access and export its authorisation records. Publishers can also confirm, renew, reject and revoke customer rights. Create an organisation in the workspace, add or accept licences at Add a licence, then create a credential at Credentials.

A declared existing licence requires publisher confirmation. Accepting published terms enables access only when all stated conditions are satisfied. The API does not take payment, deliver content or create a new purchase when you request a token.

Authentication

Send HTTP Basic authentication with your client_id as the username and the credential secret as the password. Credentials belong to an organisation and a licensing environment; use a credential matching the target publisher’s environment. Keep the secret on a trusted server, outside source control and browser code. Credential rotation immediately revokes the previous credential.

Examples use an HTTPS deployment URL. For local testing, set ASSETROUTER_API_URL=http://127.0.0.1:8000. Set ASSETROUTER_CLIENT_ID and ASSETROUTER_CLIENT_SECRET in your local secret configuration; do not paste a real secret into shared examples.

curl --fail-with-body \
  --user "$ASSETROUTER_CLIENT_ID:$ASSETROUTER_CLIENT_SECRET" \
  "$ASSETROUTER_API_URL/api/v1/library"

All routes below return JSON. Version v1 is part of the URL. Use HTTPS outside local development. These organisation credentials identify the customer organisation; they do not independently attest an individual AI agent’s identity.

Read the library

GET /api/v1/library returns an object containing licenses, an array scoped to the authenticated organisation.

Each entry contains id, publisher, tenant_id, environment, scope_id, label, verification, validity, origin, resource, pattern, publication_id, conditions and valid_until. Verification and validity are separate: publisher confirmation does not remove an expiry or revocation. Use the tenant and resource information from the confirmed licence when requesting access. Treat conditions as licence terms, not as instructions for your application to execute.

Each entry also includes coverage, selected_offer, terms_url, next_step and authorization_required. These fields let an agent discover and explain a recorded licence immediately, including while it awaits confirmation:

• coverage.resource_url is an individual URL when known; origins and path_pattern describe the publisher's currently asserted coverage. An exact path ends in $; other patterns follow the published RSL path rules.
• A collection describes coverage, not an inventory of its documents. includes_document_list is false. Obtain individual URLs from the publisher's catalog or your own workflow; AssetRouter does not crawl a collection to invent them.
• selected_offer and terms_url refer to the version accepted with this entry. Review all conditions when overlapping rows impose further restrictions. Published uses alone do not attest that this customer's access is authorized.
• next_step is await_publisher_confirmation, request_authorization or contact_publisher. It guides the workflow based on the recorded right. Only a successful authorization request decides access to the actual resource and intended use under the current service state.

For a confirmed active right, take tenant_id from the entry and the actual resource URL from coverage.resource_url or the publisher's catalog, then call /api/v1/authorizations with one intended use. On success send Authorization: License <access_token> only to the intended publisher resource server. Do not forward organization credentials to the publisher. The publisher validates the token before returning its content. A refusal is not permission to fetch through another channel.

Add or accept a licence

POST /api/v1/library submits a licence for the authenticated organisation. Required fields are scope_id, publication_id, request_key (a UUID generated by your application), origin and accept_terms: true. Obtain the scope and current publication from the publisher’s connection link and published conditions. Only submit acceptance after the customer has reviewed those conditions.

origin is existing for rights already held, direct for a purchase made directly from the publisher, or acceptance to accept its current offer. Optional fields are customer_reference, note, resource for an individual resource, and pattern / payment_type to select among multiple published offers. Supporting files can be uploaded through the workspace, not this JSON endpoint.

A successful response is HTTP 201 with the library entry. Existing and directly purchased rights await publisher confirmation. Acceptance of a free offer creates the corresponding right immediately; acceptance of a paid offer still awaits confirmation of the direct arrangement. The endpoint does not collect payment.

Reuse the same request_key and request body after an uncertain result. This returns the original entry instead of creating a duplicate. A changed publication requires a fresh review and a new request. Requests for a withdrawn offer are refused.

{
  "scope_id": "PUBLISHED_SCOPE_UUID",
  "publication_id": "REVIEWED_PUBLICATION_UUID",
  "request_key": "CLIENT_GENERATED_UUID",
  "origin": "existing",
  "customer_reference": "order-42",
  "accept_terms": true
}

Confirm customer rights as a publisher

Use credentials for the publisher organisation. GET /api/v1/requests returns its customer requests, including the customer name, reference, note and whether a private supporting document is available in the workspace. It does not expose requests addressed to other publishers.

POST /api/v1/requests/{entry_id} accepts action: confirm, renew, reject or revoke. Confirmation and renewal also require expires_at, an ISO 8601 date and time with timezone, for example 2027-01-31T23:59:59+01:00. This is the agreed expiry of the underlying right, distinct from the shorter token lifetime. The publisher must have completed the required account approval and agreements for live licensing.

Confirmation checks the same publication accepted by the customer. Renewal preserves the previous right in the history and requires a later expiry; changes to published conditions require a new customer acceptance. Revocation prevents further authorisations and causes online validation of affected tokens to fail. It cannot remove copies already delivered by the publisher.

Successful actions return HTTP 200 with the updated entry. Repeating a confirmation or revocation has no additional effect. After an uncertain renewal result, read the entry and compare its expiry before retrying. A request outside the publisher’s organisation or environment returns 404.

Request temporary access

POST /api/v1/authorizations accepts tenant_id, resource and usage. The resource is the URL you intend to access, and the usage must be permitted by the confirmed licence, for example ai-input for use as model input.

curl --fail-with-body \
  --user "$ASSETROUTER_CLIENT_ID:$ASSETROUTER_CLIENT_SECRET" \
  --header 'Content-Type: application/json' \
  --data '{"tenant_id":"PUBLISHER_TENANT_ID","resource":"https://publisher.example/report.pdf","usage":"ai-input"}' \
  "$ASSETROUTER_API_URL/api/v1/authorizations"

Replace the illustrative tenant ID and resource with values covered by your licence. A successful response contains access_token, token_type, expires_in, resource and assetrouter_token_id. expires_in describes the token lifetime in seconds. Present the token to the publisher’s server as required by the resource-server contract. AssetRouter does not fetch the resource for you.

A renewed request may issue another short-lived token. No idempotency header is required for this endpoint: issuance does not create another underlying licence or charge. After an uncertain network outcome, a retry may therefore produce another token and another request record. Never interpret a successful token response as proof that the resource was downloaded.

Read and export records

GET /api/v1/records returns schema, meaning, records and verification_keys. Each record has payload and signature. The response contains only records available to the authenticated organisation. Publishers can also review and export their records through their workspace.

curl --fail-with-body \
  --user "$ASSETROUTER_CLIENT_ID:$ASSETROUTER_CLIENT_SECRET" \
  "$ASSETROUTER_API_URL/api/v1/records" \
  --output assetrouter-records.json

The workspace’s Export licenses and records action also includes frozen licence documents, granted rights and certificates, verification keys, and the private details and supporting files submitted for those licences. Publisher exports include the customer requests addressed to that publisher. Treat the export as confidential.

AssetRouter signs the service records. Keep the verification keys with an export. The record describes a request or authorisation decision, not delivery, a model’s use of content or a third party’s independent confirmation. Downloading an export does not prepare an independent replacement service; that is a separate optional arrangement.

Errors and retries

Check the HTTP status before using a response. A 4xx response means the request was refused or invalid; inspect its JSON error and correct the cause, such as credentials, resource, usage or licence conditions. Do not repeatedly retry an unchanged refused request. Network errors and 5xx responses can be retried with a bounded delay. A timeout does not prove the original request was rejected.

Existing publisher administration and Open License Protocol integrations remain documented in the licensing API reference. New customer applications should start with the organisation routes above. For AI tooling, the MCP adapter calls the same routes with the same credentials and access rules.