Required headers

Why three credentials

dSilo data calls are protected in layers. Entra proves who the calling application is, the APIM subscription key authorizes traffic through the gateway product, and x-api-key identifies the backend API client in Mongo. Missing any one of them returns 401/403.

Authorization

Header: Authorization: Bearer <ACCESS-TOKEN>

Purpose: Microsoft Entra OAuth 2.0 access token from the client-credentials flow. Must include the Data.Read role. Expired or wrong-audience tokens are rejected.

Ocp-Apim-Subscription-Key

Header: Ocp-Apim-Subscription-Key: <SUBSCRIPTION-KEY>

Purpose: Azure API Management product subscription for Dsilo Data API – UAT. Issued after your access is approved. Do not embed live keys in documentation.

x-api-key

Header: x-api-key: <API-Key>

Purpose: Backend API client key created during onboarding. Distinct from the APIM subscription key and from Entra client secrets.

Accept

application/json — standard envelope with data, pagination, and meta.

application/vnd.apache.parquet — binary Parquet for contracts; for invoices a zip containing invoices.parquet and invoice_tables.parquet. Errors remain JSON.

Content-Type

Content-Type: application/json when the request includes a JSON body.

Support correlation

Successful and many error responses include X-Request-ID (also meta.requestId in JSON). Include that value when contacting support.