> ## Documentation Index
> Fetch the complete documentation index at: https://docs.useasterisk.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Document only operations in the linked OpenAPI contract: the source-data ingestion operations and the source-scoped outbound webhook management operations.
> Treat the generated OpenAPI document as authoritative for request fields. Never invent compatibility fields, alternate endpoints, or additional source models.
> Preserve explicit nulls, decimal strings, timestamps, source identifiers, immutable version identifiers, and document-version links exactly as defined.

# Authentication and request identity

> The source-bound bearer credential and idempotency key used by every ingestion call.

Every request uses a source-bound bearer credential:

```http theme={null}
Authorization: Bearer <source-bound-token>
Idempotency-Key: <stable-logical-request-key>
Content-Type: application/json
```

The authenticated principal determines the tenant, integration source, and actor. The request body
cannot select or override them.

## Credential boundary

### Choose an environment

| Environment | API base URL | Dashboard |
| - | - | - |
| Sandbox | `https://api.sandbox.useasterisk.com` | [Sandbox dashboard](https://sandbox.useasterisk.com) |
| Production | `https://api.useasterisk.com` | [Production dashboard](https://useasterisk.com) |

Use the sandbox for integration tests with synthetic data. Ask Karsa to provision your tenant and
integration source in each environment, then obtain a source-bound credential for that environment.
Sandbox and production have separate tenants, credentials, records, and webhook configuration.
A sandbox credential does not grant access to production, and sandbox records are not promoted
automatically. Resource and version IDs returned in one environment cannot be reused in the other.

When moving to production, change the base URL and credential together, configure your production
webhook destination, and submit your production source data. Keep the same source-ID strategy and
retry behavior used during sandbox testing.

### Source access

An active source-bound credential can call every ingestion route documented here. Karsa does not
assign a separate permission to each customer, document, transaction, or outcome route.

Tenant isolation and source ownership still apply. Suspending the source or revoking the credential
stops ingestion through that credential.

## Failure boundaries

* `401 AUTHENTICATION_REQUIRED`: no valid source-bound principal was established.
* `409 SOURCE_IDENTITY_CONFLICT`: the source identity is already bound incompatibly.
* `422 FUTURE_EFFECTIVE_AT`: the observation attempts unsupported future scheduling.
* `429 RATE_LIMITED`: the source exceeded its configured request rate.

Accepted and rejected calls carry a correlation `requestId`. Accepted calls also create an
ingestion receipt visible on the tenant's API page.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.