The PrivMatrix API lets your own systems read orders, generated packs, posture and funnel analytics, and receive real-time events when things happen. It is deliberately read-only: anything that changes data stays inside the authenticated customer portal and the admin panel. Base URL:
https://privmatrix.com/api
Create an API key in Admin → Developer → API keys. The full key is shown once, at creation. Send it as a bearer token on every request:
curl https://privmatrix.com/api/v1.php?resource=ping \ -H "Authorization: Bearer pmk_your_key_here"
Each key carries one or more scopes. A request to an endpoint outside the key's scopes returns 403 insufficient_scope. Revoke a key at any time from the same panel; revocation is immediate.
| Scope | Grants |
|---|---|
| orders.read | Orders and single-order lookup |
| packs.read | Generated packs and their law-update status |
| posture.read | Compliance posture rollup and analytics |
| leads.read | Funnel leads (partial captures) |
All endpoints are GET /api/v1.php?resource=…. Lists are newest-first, capped by limit (default 50, max 200), and accept an ISO since filter.
| Resource | Scope | Description |
|---|---|---|
ping | any | Health check; echoes your key's scopes |
orders | orders.read | List orders. Filters: status, since, limit |
order&id=… | orders.read | A single order by id |
packs | packs.read | Generated packs, each with update_available |
posture | posture.read | Pack counts by status + how many need a refresh |
analytics&window=30 | posture.read | Funnel, revenue by currency, top markets |
leads | leads.read | Recent funnel leads |
GET /api/v1.php?resource=orders&status=paid&limit=20
{
"ok": true,
"data": [
{
"order_id": "3f2c...",
"status": "paid",
"markets": ["uae","ksa"],
"amount": 2199, "currency": "AED",
"company": "Acme FZ-LLC",
"created_at": "2026-08-20T09:14:00+00:00"
}
]
}
Rate limit: 600 requests per minute per key. Over the limit returns 429 with retry_after.
Register an HTTPS endpoint in Admin → Developer → Webhooks and choose which events to receive (or all). When an event fires we POST a JSON body to your URL:
POST /your/endpoint
X-PrivMatrix-Event: order.paid
X-PrivMatrix-Timestamp: 1787393705
X-PrivMatrix-Signature: sha256=1ead1443...
{
"event": "order.paid",
"created": "2026-08-20T09:14:00+00:00",
"data": { "order_id": "3f2c...", "amount": 2199, "currency": "AED" }
}
| Event | Fires when |
|---|---|
pack.generated | A compliance pack is delivered to a customer |
pack.reissued | An archived pack is restored and re-sent |
order.paid | An order is paid (card or invoice) |
subscription.updated | A monitoring subscription changes state |
law.updated | The compliance library advances to a new version |
pack.update_available | A specific pack is affected by a law update |
Each delivery is signed with your endpoint's signing secret (shown once when you add the webhook). Compute an HMAC-SHA256 of timestamp + "." + raw_body and compare, in constant time, to the hex in X-PrivMatrix-Signature:
// PHP
$expected = 'sha256=' . hash_hmac('sha256', $timestamp.'.'.$rawBody, $signingSecret);
if (!hash_equals($expected, $signatureHeader)) { http_response_code(400); exit; }
2xx to acknowledge. Non-2xx or a timeout is retried with backoff at 1m, 5m, 30m, 2h and 6h, then marked failed after 6 attempts. Reject stale requests by checking the timestamp is recent. Endpoints must be https://.Questions or a higher rate limit? Contact info@privmatrix.com.