# IndNetGlobal API Integrations and Agent Policy

This guide is public for developers and AI agents discovering the IndNetGlobal API.

## Discovery

- Website: https://indnet.in/
- API integrations page: https://indnet.in/api-integrations
- Interactive OpenAPI reference: https://indnet.in/api/docs
- OpenAPI JSON: https://indnet.in/api/docs-json
- XML sitemap: https://indnet.in/sitemap.xml
- AI discovery index: https://indnet.in/llms.txt
- API base URL: https://indnet.in/api/v1

## Authentication and access

Public endpoints are available without a workspace credential. Private workspace endpoints require an authenticated user. For API-key integrations, send the workspace key in the `x-api-key` HTTP header over HTTPS. Create and manage workspace keys in the authenticated workspace under **Account → API Keys**.

API keys are scoped to an organization and to the permissions selected when the key is created. The owner’s current role is checked during API access. Use only endpoints and data the credential is authorized to access. A public sitemap or API reference does not grant access to private records.

Never put API secrets in URLs, public web or mobile code, source control, prompts, or logs. Do not guess, request, or reuse credentials belonging to another person or organization. Stop when an API returns an authentication or authorization error. Follow API response and rate-limit instructions; do not evade throttling or scrape private data.

## Public catalog example

The public category endpoint does not require a key:

```sh
curl https://indnet.in/api/v1/public/catalog/categories
```

For a private operation, consult the OpenAPI reference for the route and its required scopes, then supply a key only from a workspace that authorized the integration:

```sh
curl -H "x-api-key: $INDNET_API_KEY" \
  "https://indnet.in/api/v1/<authorized-private-route>"
```

Keep `INDNET_API_KEY` in a server-side secret store. Never substitute a real secret into this public document or a prompt shared with other users.

## AI agent instructions

Agents may read this page, `/llms.txt`, `/sitemap.xml`, and the public OpenAPI reference to discover supported features. Agents must use only credentials explicitly supplied by an authorized workspace administrator, honor the key’s permissions, avoid cross-organization access, and never create, reveal, or broaden credentials on the user’s behalf without authorization.