Authentication

All Admin API requests require a bearer token:

curl https://{partner}.mytraddal.com/admin/api/v1/me \
  -H 'Authorization: Bearer {access_token}'

Get a token with the client_credentials grant using an API client created in Settings → Developers → API clients:

curl -X POST https://{partner}.mytraddal.com/admin/oauth2/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=client_credentials' \
  -d 'client_id={client_id}' \
  -d 'client_secret={client_secret}'

{
  "access_token": "eyJhbGciOiJSUzI1NiIs...",
  "token_type": "Bearer",
  "expires_in": 3600
}

Scopes

Each API client is granted scopes when it’s created (and they can be amended later). A request to a route the token isn’t scoped for returns 403 { "success": false, "message": "Missing scope: …" }.

Scope	Grants
`consignments:read`	Read consignments
`consignments:write`	Create and amend consignments
`customers:read`	Read customers
`customers:write`	Create and amend customers
`catalogue:read`	Read catalogue items
`catalogue:write`	Create and amend catalogue items
`classify:read`	HS classification (`/classify/*`, `/usage-history/classify`)
`calculate:read`	Duty calculation (`/calculate/*`, `/usage-history/calculate`)
`restrict:read`	Restricted-goods checks (`/restrict/*`, `/usage-history/restrict`)
`screen:read`	Denied-party screening (`/screen`)

Tokens are also partner-bound: the organization on the token must match the {partner} subdomain you call, otherwise the request is rejected. An API client can additionally be pinned to a single customer — such a key only sees that customer’s consignments and creates on their behalf. See the authentication guide for token lifetimes and how partner isolation is enforced.

Endpoints and requests

Status and error codes

⌘I

Overview

Consignments

Classify

Calculate

Restrict

Screen

Request archive

Scopes

​Scopes

Scopes