Customer Testing. Customer Testing callers receive their API origin and authentication setup from HPH during onboarding. This site never publishes credentials, tokens, or secrets, and Production is not available.
Developer guide
Authentication and caller authority
Separate authentication, represented-organization authority, permissions, and item data.
What the caller establishes
Your approved integration authenticates through the HPH API boundary, which identifies the represented organization for every request. The API independently validates Company representation, optional partner delegation, entitlement, data restrictions, operation permission, and quota for every request.
- Organization authority comes from the authenticated caller, never from a request-body or query field.
- Direct-Company calls may legitimately have no partner or application identity.
- Partner-delegated calls require approved Company, partner, and application relationships. Some operations, such as Material Catalog Item search, the material vendor directory, and catalog changes, accept direct-Company callers only.
- Catalog-changing operations (setting or restoring a mapping, releasing a mapping, adding a catalog item, and selecting an alternative) also require the acting user to hold catalog mapping administrator access.
- Possession of an operation reference, candidate token, option reference, or cursor does not authorize a request.
- A missing or expired authentication returns 401; an authenticated caller without current authority receives 403 or a concealed 404.
What is intentionally absent
This site does not publish bearer-token examples, client secrets, service credentials, tenant identifiers, or implementation routing. Keep credentials out of request bodies, logs, support requests, and source control, and contact HPH through the onboarding channel to rotate or revoke them.