Build once. Connect your Kobiat work.

Quick start

1. Sign in through Kobiat Auth and choose an Accounts organisation/workspace.
2. Create a sandbox integration with validator:jobs:create and validator:results:read.
3. Save its one-time API key. Send it only in the Authorization header.
4. Submit synthetic records, inspect the job, and receive a signed completion event.

curl https://api.kobiat.com/sandbox/v1/validator/jobs -X POST 
  -H "Authorization: Bearer $KOBIAT_API_KEY" 
  -H "X-Organisation-ID: $ORGANISATION_ID" 
  -H "X-Workspace-ID: $WORKSPACE_ID" 
  -H "Idempotency-Key: random-unique-operation-key" 
  -H "Content-Type: application/json" 
  --data '{"records":["alice@example.invalid"]}'

Shared conventions

HTTPS, JSON, UTC ISO 8601 timestamps, explicit currency/minor units for future financial contracts, bounded scalar filters and cursor pagination up to 100 items. Request IDs are generated by the gateway and returned as X-Request-ID. Errors use application/problem+json and RFC 9457 with a stable code and request_id.

Send the organisation/workspace headers required by the contract. They select a context; they never establish permission. OAuth access tokens must have the Kobiat API audience and approved scopes. Authorization-code clients use S256 PKCE.

Write operations require a 16–100-character Idempotency-Key. Matching retries return the recorded result for 24 hours. Changed input returns 409; an unknown outcome requires inspection rather than a fresh key. No non-idempotent product call is automatically retried.

Technical throttling returns 429 and Retry-After. Use bounded backoff with jitter. Production product quotas require Billing acknowledgement; synthetic sandbox counters never become charges.

Version and availability

API v1 and webhook payload version 2026-10-28 are current. Accounts reads are connected to live Accounts authority. Validator jobs are available in the isolated synthetic sandbox at /sandbox/v1/validator/jobs. Reach, Relay, Books and production Validator require actual product/Billing adapters; requests fail closed until connected.

The sandbox has separate credentials and database tables. It permits .invalid, .test and .example addresses only, performs no real delivery/payment/validation, and consumes a technical allowance of 1,000 records per organisation per UTC day.

Searchable endpoint reference