Developers

Build on Enravo Core.

REST API, SDKs, and integration guides for partners building on Enravo Core. Schema-driven endpoints, a configurable security pipeline, and tooling designed for engineers.

REST API3ms avg latencyOAuth2 + PoP

enravo-cli

// Quick start

$ curl https://api.enravo.com/v1/schemas \

-H "Authorization: Bearer $TOKEN"

-H "X-PoP-Signature: $SIG"

// Response

{

"status": "ok",

"data": [

{ "id": "product", "endpoints": 5 },

{ "id": "order", "endpoints": 7 }

]

}

200 OK · 47ms

Quick start

Authenticate, sign a request with PoP, and query a schema endpoint — full working examples after partner authentication.

Locked

http

POST /v1/auth/session HTTP/1.1
Host: api.enravo.com
X-Client-Id: esc_a1b2c3d4e5f6
X-PoP-Signature: eyJhbGciOiJFUzI1NiJ9...
X-PoP-Nonce: n_8k2mNx4pQ7
Content-Type: application/json

{
  "credentials": {
    "type": "password",
    "identifier": "partner@example.com",
    "secret": "••••••••"
  },
  "device": { "platform": "web", "version": "2.4.1" }
}

Full code examples and copy-paste samples are available after partner authentication.

API reference

Schema-driven endpoints with consistent response envelopes, error codes, and pagination. Every endpoint passes through the Guard Pipeline.

API Reference

Authentication

Session creation, refresh, and revocation.

POST/v1/auth/sessionCreate a new authenticated session

POST/v1/auth/refreshRefresh an access token

DELETE/v1/auth/sessionRevoke current session

POST/v1/auth/verifyVerify OTP / challenge

Devices

Device enrollment, listing, and revocation.

POST/v1/devices/enrollRegister a new device

GET/v1/devicesList user's active devices

DELETE/v1/devices/:idRevoke a specific device

Schemas

Generic CRUD endpoints generated from your data schemas.

GET/v1/:schemaList entities with filters

GET/v1/:schema/:idRetrieve a single entity

POST/v1/:schemaCreate a new entity

PUT/v1/:schema/:idUpdate an entity

DELETE/v1/:schema/:idDelete an entity

Full API reference with request/response schemas is available to partners.Request access

Partner Portal

Partner portal access.

Sign in to access the full API reference, SDK downloads, sandbox environment, and integration support. New partners can request access — our team reviews applications within 48 hours.

Full REST API reference with request/response examples
SDK downloads for Kotlin, Swift, and TypeScript
Sandbox environment with test credentials
Direct integration support from our engineering team

Partner Sign In

enravo.com/partner

Secured by Enravo TrustPoP · ECDSA P-256

SDKs & tools

Official client libraries for the most common platforms. Open API specs and tooling for everything else.

Available

Kotlin SDK

Android · JVM · v2.4.1

Official Kotlin SDK for Android and JVM. Built-in PoP signing, Keystore integration, and reactive APIs.

Request access

Available

Swift SDK

iOS · macOS · v2.3.0

iOS and macOS client with Secure Enclave key generation, async/await APIs, and Combine support.

Request access

Beta

TypeScript SDK

Node · Browser · v1.8.0

Universal TypeScript SDK with full type inference from your schemas. Works in Node.js and the browser.

Request access

Available

Enravo CLI

Command line · v1.2.0

Manage clients, devices, schemas, and policies from the terminal. Includes scaffolding and migrations.

Request access

Beta

OpenAPI Spec

OpenAPI 3.1 · vv1

Complete OpenAPI 3.1 specification for the entire Enravo Core API. Generate clients in any language.

Request access

Soon

Postman Collection

Postman · v2026.04

Ready-to-import Postman workspace with pre-configured environments, auth flows, and example requests.

Request access

Resources

Architecture, security model, and platform documentation — open to everyone.

Architecture

How Enravo Core is structured. Layers, modules, and the request lifecycle.

Module System

How modules register, declare schemas, and boot in dependency order.

Schema Engine

Define data as schemas — CRUD, validation, and permissions auto-generated.

APIs

API Engine

REST conventions, response envelopes, error codes, and pagination.

Meta System

Extend entities with metadata fields — typed, validated, role-scoped.

Caching

Namespace-based cache, hook-driven invalidation, HTTP cache headers.

Security

Guard Pipeline

Six configurable verification stages per request — JWT, Device, PoP, App, Ability, Policy.

Proof of Possession

How ECDSA P-256 request signing makes stolen tokens useless.

Device Binding

Sessions bound to hardware. Device limits, enrollment, and revocation.

Ready to build with us?

Apply for partner access and get full API documentation, SDK downloads, and direct integration support from our team.

POST /v1/auth/session HTTP/1.1 Host: api.enravo.com X-Client-Id: esc_a1b2c3d4e5f6 X-PoP-Signature: eyJhbGciOiJFUzI1NiJ9... X-PoP-Nonce: n_8k2mNx4pQ7 Content-Type: application/json { "credentials": { "type": "password", "identifier": "partner@example.com", "secret": "••••••••" }, "device": { "platform": "web", "version": "2.4.1" } }

Partner portal access.

Sign in to access the full API reference, SDK downloads, sandbox environment, and integration support. New partners can request access — our team reviews applications within 48 hours.

Full REST API reference with request/response examples

SDK downloads for Kotlin, Swift, and TypeScript

Sandbox environment with test credentials

Direct integration support from our engineering team