[ Partner Interface // v1 ]

Aurelia Partner API

A keyed, scoped REST surface for concierge and family-office platforms. Submit acquisition mandates, read curated off-market intercepts, and receive signed webhooks as each mandate advances. Zero custody: the API never moves funds and never returns vendor contact data.

https://eqxgnxgbvvrjaxjiznjo.supabase.co/functions/v1/aurelia-api/v1

Keys are issued by the desk. Request partner access or speak to the desk.

Machine-readable contract: /openapi/aurelia-v1.json (OpenAPI 3.1 — import into Swagger UI, Postman, Insomnia or an AI agent toolchain).

Authentication

Send your key in x-api-key on every request (a Authorization: Bearer qp_live_… header is also accepted). Keys are hashed at rest, scoped, expiring and rate limited per minute. Write calls accept an idempotency-key header so retries never duplicate a mandate.

mandates:write

Create and cancel mandates.

mandates:read

List and read mandates, including the matched intercept.

deals:read

Read curated intercepts released to partners.

clients:write

webhooks:write

*

All of the above. Issued only for sandbox keys.

Quickstart

The SDK is a single dependency-free TypeScript file: drop it into your codebase. It handles key auth, idempotency keys, and exponential-backoff retries that honour Retry-After.

TypeScript

import { createAureliaClient } from "./aurelia-client";

const aurelia = createAureliaClient({
  apiKey: process.env.AURELIA_API_KEY!,   // qp_live_…
  maxAttempts: 4,                          // retries 429 / 5xx with backoff
});

const { partner, scopes } = await aurelia.ping();

const { mandate } = await aurelia.mandates.create({
  vertical: "aviation",
  brief: "Ultra-long-range jet, EASA, sub-4000ft field performance, discreet close.",
  external_ref: "AUR-2026-0148",
  currency: "GBP",
});

Endpoints

Health

Introspect the presented key: partner slug, granted scopes, API version.

Clients

List the end-clients registered under your partner slug.

Mandates

Submit an acquisition mandate. Upserts on your external_ref and fires mandate.created.

List your mandates, newest first, optionally filtered by status.

Read one mandate in full, with the matched intercept inlined once matched.

Withdraw a mandate. Fires mandate.status_changed.

Internal progress timeline for a mandate: intake, sourcing, candidates, notes and status moves.

Read the two-way note thread on a mandate, oldest first. Replaces email follow-ups.

Post a note onto the mandate thread. Visible to the Quantus desk, appended to the timeline.

Intercepts

Curated intercepts released to partners. Filter by category and minimum Quantus score.

Read one curated intercept.

Introductions

Submit a private introduction. The desk follows up directly.

Webhooks

List your endpoints with delivery health. Secrets are never returned.

Deactivate an endpoint. Delivery history is retained for audit.

Inspect delivery attempts for an endpoint: status, HTTP code, attempt count and next retry.

Re-send a past delivery byte for byte with a fresh signature, once your endpoint is healthy again.

Webhooks

Each delivery carries x-quantus-signature: t=<unix>,v1=<hex> — an HMAC-SHA256 of `${timestamp}.${rawBody}` using the secret returned once at registration. Verify against the raw body and reject timestamps outside a 300-second window. Failed endpoints are retried by the desk and every attempt is auditable.

mandate.created

A mandate was accepted onto the production ledger.

mandate.status_changed

A mandate advanced (triaging, sourcing, matched, closed, cancelled, rejected).

deal.matched

An intercept was matched to one of your mandates.

introduction.received

A private introduction you submitted was logged.

Verification

import { verifyWebhookSignature } from "./aurelia-client";

// Express / Hono / Deno — always verify against the RAW body.
const raw = await req.text();
const result = await verifyWebhookSignature({
  secret: process.env.QUANTUS_WEBHOOK_SECRET!,
  header: req.headers.get("x-quantus-signature"),
  body: raw,
  toleranceSeconds: 300,
});

if (!result.valid) {
  console.warn("rejected webhook:", result.reason);
  return new Response("invalid signature", { status: 400 });
}

switch (result.event.event) {
  case "deal.matched":
    // result.event.data.mandate.matched_deal_id
    break;
  case "mandate.status_changed":
    break;
}
return new Response("ok");

Errors

Every failure returns { "error": { "code", "message" } }. Validation failures add a fields map. The SDK throws AureliaApiError carrying all three.

401missing_api_key

No x-api-key header (or bearer qp_ token) was presented.

401invalid_api_key

Key is malformed, unknown or revoked.

401expired_api_key

Key passed its expiry date.

403not_a_partner_key

Key exists but is not provisioned for the partner API.

403insufficient_scope

Key lacks the scope this endpoint requires.

400invalid_request

Validation failed. `fields` lists the offending keys.

404not_found

Resource does not exist, or is not visible to this key.

404unknown_route

No handler for that method and path.

404unknown_version

The /v1 prefix is missing.

409mandate_not_approved

The mandate behind this delivery is not operator-approved for release, so it cannot be replayed or sent.

429rate_limited

Per-minute quota exceeded. Honour `Retry-After`.

500read_failed

The ledger read failed. Retry; the call had no side effects.

500write_failed

The write was rejected by the ledger. Retry with the same idempotency key.

500auth_unavailable

Credential store was unreachable. Retry after a short backoff.

500internal_error

Unexpected failure. Safe to retry with the same idempotency key.

Partner integration questions

How does a concierge platform authenticate with the Quantus Pulse partner API?

Send your desk-issued key in the x-api-key header on every request (Authorization: Bearer qp_live_… is also accepted). Keys are hashed at rest, scoped per capability, expiring, and rate limited per minute.

Can partners submit acquisition mandates on behalf of their own clients?

Yes. Register the client, then POST the mandate with its budget, vertical, and jurisdiction. Send an idempotency-key header so retries never duplicate a mandate, and Quantus Pulse returns the existing record on replay.

How are partner webhooks verified?

Each delivery carries x-quantus-signature: t=<unix>,v1=<hex>, an HMAC-SHA256 of `${timestamp}.${rawBody}` using the secret returned once at webhook registration. Verify against the raw body and reject timestamps outside a 300-second window.

Does the partner API expose vendor contact details or move money?

No. The API is zero-custody: it never moves funds and never returns vendor contact data. Partners receive curated intercept intelligence and mandate state only.

Is there a machine-readable spec or SDK?

Yes. The OpenAPI 3.1 contract is published at /openapi/aurelia-v1.json, and a dependency-free TypeScript SDK handles key auth, idempotency keys, and exponential-backoff retries that honour Retry-After.