Company provisioning API

Use the Partner API from a trusted server to operate company credentials and reconcile account activity. Its standard origin is https://p-api.b2b-llm.com. It is distinct from the inference origin and does not use an interactive browser session.

Authorization boundary

A verified company owner generates a mg_partner_... credential in Profile. Save the complete value at creation or rotation; only a hash and display prefix are retained for routine administration. Employee Model API credentials do not authorize owner provisioning.

Authorization: Bearer mg_partner_...
Accept: application/json

Company and personal API IP policies are both enforced when present. Do not expose a Partner token in an editor extension, frontend bundle or shared chat configuration.

Reliable mutations

POST, PATCH and DELETE require Idempotency-Key. Give each logical operation its own key. Retry the same method/path/body with the original key after an uncertain transport result; the encrypted operation result is retained for seven days. Reusing that key for a different operation returns 409 rather than changing the earlier result.

The management rate limit defaults to 600 operations per minute per account and is configurable by the operator. Read the rate-limit headers and honor Retry-After; do not retry continuously. JSON errors, X-Request-ID and Cache-Control: no-store also apply to unsupported methods and missing resources.

Values and records

Pass monetary values as decimal strings and preserve their precision. Public identifiers, not numeric database IDs, address keys, projects and requests. Timestamps are UTC RFC3339. Collections use opaque cursors; follow them without decoding or inventing positions.

The operation reference contains request/response shapes. Detailed request history has a configured hot-retention window, normally seven days; use the durable balance journal for longer-term reconciliation. Raw prompts and provider response bodies are not part of ordinary history responses.

Partner-created Business keys use the owner as their credential principal. An explicitly supplied project must belong to that company and be active. Employee assignment is an account-workspace operation, not an arbitrary identity field in the Partner request.