airbase v1.0.0

The pack names a reference, never a secret. Installing a pack registers capabilities and makes them governable; registration is not connectivity. The credential is created at the provider and held in the client's own secret manager under the reference the pack names, and deployment testing is still required to show the credential path works and cannot be bypassed.

Reference

secret-ref-airbase-api-token

Custody

customer_vault

Injection

header (Authorization)

An Airbase API credential, held in the client's own secret manager. The only authentication observation available to this review is that api.airbase.io answers a request sent without an Authorization header with its own error 'Authorization header is missing' — that missing-header error shows the host expects some credential on an Authorization header, and establishes NOTHING more: nothing about the credential's issuance process, format, scheme, expiry, revocation path or scope behaviour. The scheme is NOT verifiable from the official documentation available to this review — the stored material must be the complete Authorization header value (scheme included), and the scheme must be confirmed against the invite-only API reference before enabling. API access itself is invite-only, granted through an Airbase Program Manager; the actual issuance process, credential format, expiry, revocation and scope behaviour are NOT established by anything available to this review and must be established from the invite-only onboarding and reference before enabling; if issuance involves an external token-minting process, the underlying client secret stays with that process, and an expired or revoked value must fail closed. Least privilege: request a credential whose permissions cover only the reads this pack registers — vendors, purchase orders, bills, cards and subsidiaries — and no write, approval, card-issuance or payment permission, confirming against the reference what permission granularity actually exists. Executor hygiene: the credential must live only in executor memory for the lifetime of a call, must never be written to logs, traces or diagnostics, and must never appear in crash reports; the executor's memory, log and crash handling are otherwise the deployment's review.

• airbase-vendors (api, pii): https://airbase-docs-invite-only.invalid/v1/vendors/
• airbase-purchase-orders (api, financial): https://airbase-docs-invite-only.invalid/v1/purchase-orders/
• airbase-bills (api, financial): https://airbase-docs-invite-only.invalid/v1/bills/
• airbase-cards (api, financial): https://airbase-docs-invite-only.invalid/v1/cards/
• airbase-subsidiaries (api, internal): https://airbase-docs-invite-only.invalid/v1/subsidiaries/

READ THIS BEFORE ENABLING ANYTHING. Airbase's official developer portal (developer.airbase.io) documents exactly one API — the Airbase Guided Procurement API — and states it is invite-only: access to the API and its related documentation is granted through an Airbase Program Manager, so the endpoint reference was NOT readable for this review. What this review observed on 2026-09-21, stated precisely: the host api.airbase.io is live and answers unauthenticated requests with its own JSON error naming the Authorization header as the expected credential carrier; and unauthenticated GET requests to /v1/vendors/, /v1/purchase-orders/, /v1/bills/, /v1/cards/ and /v1/subsidiaries/ returned 401 while unknown paths under /v1/ returned 404. That differentiated 401/404 behaviour is route evidence ONLY: authentication middleware can reject a request before method dispatch or application routing, so these observations do NOT establish that these paths are documented public GET collection operations, that GET (or any method) is supported on them, that they are part of the public API at all, or what they return. Method support, public-API status, parameters, response shapes, pagination and read semantics are therefore UNVERIFIED and must be confirmed against the invite-only reference before enabling; this pack stays in the draft review state until that confirmation happens. Because the probed host is real but its semantics cannot be verified, this scaffold registers the reserved non-production authority 'airbase-docs-invite-only.invalid' (an RFC 2606 reserved TLD) rather than the live host — a real host we cannot verify semantics for would be worse than a placeholder: before enabling, a reviewer with access to the invite-only reference must verify every path, method and payload and substitute the real host and the verified paths in every endpoint, every resource locator and every egress allowlist entry — the allowlist matches exactly, so all three must be substituted together. Allowlisting the reserved host does not make an unsubstituted pack safe: an unsubstituted pack fails closed at DNS but has no reviewed destination, so it is not a registration of anything. (Probe detail, retained as observation only: the unauthenticated /v1/vendors path redirected to /v1/vendors/, which is why the candidate paths carry the trailing-slash form; AAES does not follow redirects.) Every capability here is registered as a collection read at R0 with semantics to be confirmed against the invite-only reference before enabling. Scoped-but-unverifiable capabilities, framed as what this pack does not register: transactions read and users read — candidate transaction and user paths probed on 2026-09-21 returned 404, with the same caveat in the opposite direction (an unauthenticated 404 does not prove non-existence either, so these candidates simply could not be supported); purchase requests read — no purchase-request route could be supported; approvals and every approval action; virtual card issuance and every other write; payments; reimbursements; and webhooks. AAES has not been certified by Airbase or Paylocity; nothing here is a vendor guarantee.

Draft review record dated 2026-09-21 · Reviewer: aaes-eng (an opaque id that resolves internally to the responsible reviewer)

• https://developer.airbase.io/ (retrieved 2026-09-21) — portal landing page only: documents the invite-only Guided Procurement API; the endpoint reference was not readable
• https://api.airbase.io/ (retrieved 2026-09-21) — unauthenticated probe observations only (differentiated 401/404 responses, missing-header error); route evidence only, not evidence of operation semantics

A pack review is not a vendor or examiner attestation. A retrieval date says when a source page was read; it does not by itself establish what the page said then. No pack is vendor-endorsed, and none has been connectivity-tested against a live vendor tenant.