Skip to main content
Every request is authenticated with an API key sent in the Authorization header.

​
API keys

The doola team issues your first API key for each environment. After that, signed-in Partner Portal users create, revoke and delete keys themselves, and you can hold several at once.
Treat API keys as secrets. Use them only from your backend, never in client side code. A sandbox key does not work against production, and the reverse is also true.
Manage your keys and webhook endpoint in the doola Partner Portal, including rotating a key. Don’t have access yet? Get API access.

​
Request headers

​
Idempotency

The create endpoints (POST /v1/partner/customers and POST /v1/partner/companies) require an Idempotency-Key.
  • Use a unique value per logical operation, for example a UUID tied to your own record.
  • Retrying with the same key and the same body returns the original result and never creates a duplicate.
  • If a create fails before it commits — a validation or pre-check 4xx, or a transient 5xx — the key is released. Fix the request and retry with the same key (you do not need a new one).
  • Once a create has succeeded, reusing its key with a different body returns 409 E_IDEMPOTENCY_KEY_REUSED.
  • While a create with a given key is still in flight, a concurrent retry of that key returns 409 E_IDEMPOTENCY_IN_PROGRESS; retry after a short delay.
Last modified on October 13, 2026