You deposit attested data into ORBIS, or receive events out of it, through the bridge and webhook plane.

What ORBIS needs from you

• The organization the data belongs to, and the deposit contract version you build against.
• An HTTPS endpoint that can receive a signed webhook, on a public host — the SSRF allowlist is re-checked on every delivery attempt, not just at registration.
• Who is accountable for the data you deposit.

What the platform will prove before you go live

Not checkboxes — the real exercises, run against your integration, each recording the evidence it saw. This is what replaces weeks of email, and what stops anyone reaching production on a broken integration.

• Your webhook endpoint returns the correct HMAC-SHA256 signature for a signed challenge.
• You deduplicate on x-orbis-delivery — retries are real.
• A deposit with a malformed or unknown shape is refused rather than half-applied.

Not built The engine that runs these is being built now. When it is wired, each check on your status page carries what it proves, what it saw, and — on a failure — the concrete fix.

The calls

Copy-pasteable, in order. Nothing here has been executed against the production origin and no value below is live data. Run everything against a demo- organization first.

curl -sS https://orbis.id/api/tenants/<tenant>/bills \
  -H "authorization: Bearer $ORBIS_OPERATOR_TOKEN" \
  -H 'content-type: application/json' \
  -d '{"externalRef":"<your id>", ... }'
# The exact contracted shape is in /openapi.json — read it there rather than
# from this page, so there is one source and it cannot drift.

import { createHmac, timingSafeEqual } from 'node:crypto';

export function verifyOrbisWebhook(rawBody: string, header: string | null, secret: string): boolean {
  if (!header) return false;
  const m = /^sha256=([0-9a-f]{64})$/i.exec(header.trim());
  if (!m) return false;
  const expected = Buffer.from(createHmac('sha256', secret).update(rawBody, 'utf8').digest('hex'), 'hex');
  const given = Buffer.from(m[1].toLowerCase(), 'hex');
  return expected.length === given.length && timingSafeEqual(expected, given);
}

// Headers ORBIS sends:
//   x-orbis-signature: sha256=<hex>   HMAC-SHA256 of the RAW body
//   x-orbis-event:     <event type>
//   x-orbis-delivery:  <delivery id>  ← your idempotency key. Retries are real.
// Read the RAW body: if your framework re-serialised the JSON, the bytes
// changed and the signature will never match.

Operations used on this path: POST /api/tenants/{tenant}/bills. Their request and response shapes are in /openapi.json.

What happens next

1. Applied ORBIS acts

   Your application exists and is in the review queue. Nothing has been provisioned.

   What moves it: An ORBIS reviewer picks it up. You do not need to do anything.

2. Reviewing ORBIS acts

   A reviewer is reading it and may come back to you with questions.

   What moves it: The reviewer either asks you something or moves you to a sandbox.

3. Sandbox you act

   You have a demonstration organization to build against. It is marked as a demo everywhere, permanently.

   What moves it: You build the integration, then ask for certification.

4. Certifying you act

   The platform is running the real exercises against your integration and recording the evidence.

   What moves it: Every check on the readiness board passes. Each failure names the concrete fix.

5. Live nobody waits

   You are a provisioned organization on the production rail.

   What moves it: Nothing — this is the destination. Your organization is now managed in Organizations, not here.

No duration is published for these stages because none has been measured — see the pipeline for why that is deliberate.

Already a partner? Sign in to the partner portal to see your status, issue and revoke your own API keys, and manage who else is on your account. To read your status without signing in, /partners/status takes your reference and contact email and nothing else.

The API reference lives at /developers and the machine-readable contract at /openapi.json. Nothing on this page restates them — they are the one source.