Tendios Developers

Appearance

Authentication ​

The Tendios public API uses API keys for authentication. Every request must include your API key in the api-key header.

Sending your API key ​

bash
curl https://api-rest.tendios.com/api/v1/tenders/search \
  -H "api-key: tend_your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{ "text": "construction" }'

Key format ​

API keys are prefixed with tend_ followed by a 64-character hex string:

tend_a3f2c1d4e5b6...

Getting an API key ​

Access to the Tendios API is available to enterprise clients.

Generate your own key ​

If your plan includes API access, you can create and manage your key yourself — no need to contact us. Go to Settings → Subscription → Integrations:

https://bid.tendios.com/settings/account/subscription/apikeys

From there you can generate a key, choose whether it is read-only, disable and re-enable it, or delete it.

The key is shown only once

The full key is displayed only at the moment you create it. Copy it and store it somewhere safe — if you lose it, you'll have to delete the key and generate a new one.

Two things to know:

  • You need to be an account admin to open this page.
  • If your plan doesn't include API access, the page isn't available and you'll be redirected to the plans page.

Ask us for one ​

If you don't have API access on your plan, or you'd rather we set it up for you, contact us at support@tendios.com.

Read-only and full-access keys ​

Each key is either read-only or has full access. New keys are read-only unless you choose full access when you create them, and you can switch a key between the two at any time on the same settings page.

  • A read-only key can call every GET endpoint and the endpoints that read data through a request body: Search tenders, Get alert tender results and Get market awards.
  • Any other write — creating or updating alerts, moving opportunities, creating tasks — is rejected with 403 Forbidden:
json
{
  "statusCode": 403,
  "message": "This API key is read-only and cannot call write operations"
}

Use full access only for integrations that need to change data.

Keeping your key safe ​

  • Never expose your API key in client-side code or public repositories
  • If your key is compromised, disable or delete it right away and generate a new one — or contact support@tendios.com and we'll rotate it for you
  • An account can hold up to 5 keys; disabled keys count until you delete them

© Tendios