About the API

The reference pages under this section are generated directly from the TrustWix OpenAPI document, so they describe exactly what the API accepts and returns. The document itself is published at /openapi.json if you want to generate a client, mock server or types from it.

Base URL

https://api.trustwix.com

One host serves both environments. Which one you are in is decided by the key you authenticate with. The environment is set on the key when it is created and shown against it in the console, rather than encoded in the key string. See Authentication.

Conventions

Requests and responses are JSON. Send Content-Type: application/json on anything with a body. Timestamps are RFC 3339 strings in UTC. Object ids are prefixed by type, so vs_ is a verification, chk_ a check, flw_ a flow and evt_ a webhook event, which makes a stray id in a log self-describing.

Every response carries X-Request-Id. You can supply your own and it is echoed back.

List endpoints are cursor-paginated and newest first. Pass limit and starting_after, and read has_more and next_cursor from the response rather than counting.

Stability

The API is versioned in the path at /v1. Within a version, changes are additive: new endpoints, new optional request fields and new response properties can appear without notice, and existing fields do not change meaning or disappear. Anything incompatible ships as a new version, and /v1 keeps working.

The same applies to enumerated values. New reason codes, new webhook event types and new check types are additive, so always have a default branch.

Reliability

Send an Idempotency-Key when you create a verification, the one call that honours it, see Idempotency. Respect the rate limit headers and back off with jitter, see Rate limits. Every failure uses one envelope, see Errors.

Where to start

Verifications is the endpoint set almost every integration needs. Everything else exists to support it.