Airbase package v1.0.0

An Airbase API credential held in the client’s own secret manager. The live host’s missing-Authorization-header error establishes the expected header name only. It establishes no issuance process, credential format, scheme, expiry, revocation, or permission model.

Store the complete Authorization header value, including the scheme. Confirm its format against the invite-only reference before enabling. API access is granted through an Airbase Program Manager; confirm issuance, expiry, revocation, and permission behavior through that onboarding and reference. If an external process mints tokens, keep the underlying client secret with that process. An expired or revoked value must fail closed.

Least privilege: request only the permissions needed for the candidate vendor, purchase-order, bill, card, and subsidiary reads. Exclude write, approval, card-issuance, and payment permissions. Confirm the provider’s actual permission granularity rather than assuming separate read scopes exist.

Executor hygiene: keep the credential in executor memory only for the call’s lifetime. Never include it in logs, traces, diagnostics, or crash reports. The deployment owns the executor’s memory, logging, and crash-handling controls.

Do not enable this scaffold until the invite-only reference has been reviewed. The official developer portal documents the Guided Procurement API and grants API and documentation access through an Airbase Program Manager. The endpoint reference was unavailable to this review, so method support, public-API status, parameters, response shapes, pagination, and read semantics remain unverified. The pack remains in draft until those contracts are confirmed.

The reserved host airbase-docs-invite-only.invalid is a non-production RFC 2606 placeholder. After reviewing the invite-only reference, replace it with the verified API host and paths in every endpoint, resource locator, and egress allowlist entry. The allowlist matches exactly, so update all three together. An allowlisted placeholder is not a reviewed destination and must not be enabled as shipped.

Route observations dated 2026-09-21 do not establish operation semantics. The live api.airbase.io host returned an Authorization-header error, 401 for the candidate /v1/vendors/, /v1/purchase-orders/, /v1/bills/, /v1/cards/, and /v1/subsidiaries/ paths, and 404 for unknown paths. Authentication middleware can reject before method dispatch or application routing: those responses establish neither public GET support nor returned data. A 404 also does not establish that an operation is absent. The /v1/vendors path redirected to /v1/vendors/, explaining the candidate trailing slash; AAES does not follow redirects.

Registered scope: five candidate collection reads at R0, subject to confirmation. Single-record reads are excluded. Transaction and user reads could not be supported by the available route observations; no purchase-request route could be supported either. The pack also excludes approvals and approval actions, virtual card issuance and every other write, payments, reimbursements, and webhooks.

AAES has not been certified by Airbase or Paylocity; this configuration is not a vendor guarantee.

Source annotation for https://developer.airbase.io/ (retrieved 2026-09-21): portal landing page describing the invite-only Guided Procurement API; no endpoint reference available. Source annotation for https://api.airbase.io/ (retrieved 2026-09-21): route responses and missing-header error only; no operation contract established.

Re-review on 2026-10-29: the web reader retrieved only the Paylocity portal shell from https://developer.airbase.io/. Candidate OpenAPI URLs were inaccessible through that tool; the vendor GitHub pages yielded no operation reference. The browser fallback was unavailable. No operation or credential contract was verified, and this pack remains draft. The invite-only access requirement is the earlier portal finding, not newly retrieved endpoint evidence.