openapi: 3.0.1
info:
title: Public Prewave Actions Exposure API
description: 'Documentation of the Public Prewave API.
## What''s New
### Q1 2026 — Supplier Management, User Management, Actions and Feed
This quarter introduces major v2 upgrades, expanded administrative capabilities, and the new Actions API.
- **Core Releases:** Deployed Supplier Management API v2 and Feed API v2, alongside the all-new Actions API.
- **Enhanced Functionality:** Added robust identifier management, granular user and role configuration, and endpoints for managing supplier connection contacts.
- ⚠️ **Required Migration:** Legacy v1 endpoints for Suppliers and Sites Upsert have been deprecated. Developers must migrate existing integrations to v2 by **May 31, 2027** (original deadline was December 31, 2026).
📖 **[Read the Q1 2026 changelog](https://docs.prewave.com/en/articles/699847-q1-2026-public-api-updates)**
### Q2 2026 — Supplier Screening and External Scores
We have expanded our v2 documentation to include comprehensive integration guidance for supplier screening and validation workflows and identifier-based external score ingestion.
- **New Capabilities:** Added support for optional post-onboarding screening and validation during the create event.
- **External Scores:** Batch POST for multiple supplier sites, per-site history GET, and event-type discovery GET (`/public/v1/scores/externals` and `/public/v1/scores/externals/event-types`). Documented in OpenAPI when enabled for your organization.
- **Developer Resources:** Published new integration examples and detailed identifier validation rules to streamline your implementation process.
📖 **[Read the Q2 2026 changelog](https://docs.prewave.com/en/articles/699849-q2-2026-public-api-updates)**
### Q3 2026 — Scores Webhooks
To support event-driven architectures and eliminate the need for continuous API polling, we are introducing webhooks for score state changes later this year.
- **Event-Driven Architecture:** Register webhook URLs to receive real-time HTTP payloads whenever a supplier''s score updates, so you can drive immediate mitigation responses without polling the API.
- **Availability:** Comprehensive OpenAPI specifications and payload schemas will be published closer to the release date.
- **Note:** Schemas and behaviors are subject to refinement prior to general availability.
Documentation updates will be provided prior to release.
### Q4 2026 — Feed V2
We are enhancing Feed API v2 with additional capabilities on top of the existing `GET /public/v2/feed` contract (see Q1 changelog and OpenAPI for the current Feed v2 integration).
- **Availability:** Details will be announced before release.
- **Note:** Schemas and behaviors are subject to refinement prior to the official release.
Documentation updates will be provided prior to release.
---
## Authentication
Prewave’s public api uses *API tokens* to authenticate against our RESTful service. We’ll provide you an *API-token* that each
endpoint needs present as a http header.
To pass the token in a request, simply add it as a header-parameter with
* key = X-Auth-Token
* value = api-token
See an example in curl below where the api-token would be 12345678-90ab-cdef-1234-567890abcdef
```
curl --request GET \
--url https://REPLACE_WITH_SERVER/public/v1/target/prewave/3975230/alerts \
--header ''X-Auth-Token: 12345678-90ab-cdef-1234-567890abcdef''
```
---
## Manage API Tokens
Before you can obtain your API token, you''ll need the credentials for your API user. These credentials will be
sent to you as part of the company-onboarding. If you haven''t got your credentials yet, please reach out to
your sales-contact at Prewave or contact us via info@prewave.ai
To generate an API Token, navigate to https://www.prewave.com/management/api and log in with the
credentials of your API user. Then click at the button "Create New" and use your new api-token authentication as a header parameter.
You can create multiple API tokens and also remove existing API tokens on https://www.prewave.com/management/api.
API tokens do not expire, therefore you have to maintain the list of API tokens you are using manually.
---
## Default Rate Limits
We have two types of default rate limits. For increased access, please contact customer success.
| Type | Requests per 10 seconds | Requests per Minute |
|-----------------------------------|-------------------------|---------------------|
| GET requests | 100 | 500 |
| POST, PUT, PATCH, DELETE requests | 20 | 100 |
'
version: '1.0'
servers:
- url: https://api.prewave.com
description: Production Environment
security:
- Token authentication: []
tags:
- name: Exposure
description: Get exposure analysis graph and targets
paths:
/public/v1/alpha/exposure/target/{targetId}/graph:
put:
tags:
- Exposure
summary: Get exposure graph by target id
description: '**Performance impact**: Medium'
operationId: getExposureGraphByTargetId
parameters:
- name: targetId
in: path
required: true
schema:
type: integer
format: int32
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/BaseExposurePayload'
required: true
responses:
'200':
description: OK
content:
'*/*':
schema:
$ref: '#/components/schemas/ExplorerGraph'
'403':
description: '403 Forbidden - Authentication or authorization failure. This status code is returned when: (1) the request lacks valid authentication credentials (missing or invalid X-Auth-Token header), or (2) the authenticated user does not have the required permission to access this resource.'
content:
application/json:
schema:
$ref: '#/components/schemas/AccessDeniedErrorDTO'
examples:
Access denied example:
summary: User lacks necessary permissions or authentication
value: "{\n \"loggedIn\": true,\n \"code\": \"access_denied\",\n \"message\": \"Access denied: you don't have necessary permissions to access this resource\",\n \"solution\": \"Contact support for appropriate permissions\"\n }"
'500':
description: 500 Internal Server Error - An unexpected error occurred on the server. The request may or may not have been processed.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorDTO'
examples:
Error - Server Error:
summary: Unexpected server error
value: "{\n \"code\": \"internal_error\",\n \"message\": \"An unexpected error occurred\",\n \"solution\": \"Please try again later or contact support\"\n }"
'429':
description: '429 Too Many Requests - API rate limit exceeded. The request has been rejected because the rate limit for this endpoint has been exceeded. Default rate limits: GET requests - 100 per 10 seconds, 500 per minute; POST/PUT/PATCH/DELETE requests - 20 per 10 seconds, 100 per minute. For increased access, please contact customer success.'
content:
application/json:
schema:
$ref: '#/components/schemas/ApiRateLimitResponse'
examples:
Rate limit exceeded example:
summary: API rate limit exceeded
value: "{\n \"error\": \"API rate limit exceeded\",\n \"message\": \"You have reached the maximum allowed requests. Please try again later or upgrade your plan for increased access\",\n \"requestLimit\": 20,\n \"requestCount\": 20,\n \"limits\": [\n {\n \"requestLimit\": 20,\n \"timeInSeconds\": 10\n },\n {\n \"requestLimit\": 100,\n \"timeInSeconds\": 60\n }\n ],\n \"currentTime\": \"2026-01-15T10:30:00\",\n \"nextResetAt\": \"2026-01-15T10:30:10\"\n }"
/public/v1/alpha/exposure/target/{systemId}/{targetId}/graph:
put:
tags:
- Exposure
summary: Get exposure graph by foreign system target id
description: '**Performance impact**: Medium'
operationId: getExposureGraphByForeignSystemTargetId
parameters:
- name: systemId
in: path
required: true
schema:
type: string
- name: targetId
in: path
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/BaseExposurePayload'
required: true
responses:
'200':
description: OK
content:
'*/*':
schema:
$ref: '#/components/schemas/ExplorerGraph'
'403':
description: '403 Forbidden - Authentication or authorization failure. This status code is returned when: (1) the request lacks valid authentication credentials (missing or invalid X-Auth-Token header), or (2) the authenticated user does not have the required permission to access this resource.'
content:
application/json:
schema:
$ref: '#/components/schemas/AccessDeniedErrorDTO'
examples:
Access denied example:
summary: User lacks necessary permissions or authentication
value: "{\n \"loggedIn\": true,\n \"code\": \"access_denied\",\n \"message\": \"Access denied: you don't have necessary permissions to access this resource\",\n \"solution\": \"Contact support for appropriate permissions\"\n }"
'500':
description: 500 Internal Server Error - An unexpected error occurred on the server. The request may or may not have been processed.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorDTO'
examples:
Error - Server Error:
summary: Unexpected server error
value: "{\n \"code\": \"internal_error\",\n \"message\": \"An unexpected error occurred\",\n \"solution\": \"Please try again later or contact support\"\n }"
'429':
description: '429 Too Many Requests - API rate limit exceeded. The request has been rejected because the rate limit for this endpoint has been exceeded. Default rate limits: GET requests - 100 per 10 seconds, 500 per minute; POST/PUT/PATCH/DELETE requests - 20 per 10 seconds, 100 per minute. For increased access, please contact customer success.'
content:
application/json:
schema:
$ref: '#/components/schemas/ApiRateLimitResponse'
examples:
Rate limit exceeded example:
summary: API rate limit exceeded
value: "{\n \"error\": \"API rate limit exceeded\",\n \"message\": \"You have reached the maximum allowed requests. Please try again later or upgrade your plan for increased access\",\n \"requestLimit\": 20,\n \"requestCount\": 20,\n \"limits\": [\n {\n \"requestLimit\": 20,\n \"timeInSeconds\": 10\n },\n {\n \"requestLimit\": 100,\n \"timeInSeconds\": 60\n }\n ],\n \"currentTime\": \"2026-01-15T10:30:00\",\n \"nextResetAt\": \"2026-01-15T10:30:10\"\n }"
/public/v1/alpha/exposure/{id}:
get:
tags:
- Exposure
summary: Get exposure analysis info by exposure analysis id
description: '**Performance impact**: Medium'
operationId: getExposureAnalysisById
parameters:
- name: id
in: path
required: true
schema:
type: integer
format: int32
responses:
'200':
description: OK
content:
'*/*':
schema:
$ref: '#/components/schemas/ExposureAnalysis'
'403':
description: '403 Forbidden - Authentication or authorization failure. This status code is returned when: (1) the request lacks valid authentication credentials (missing or invalid X-Auth-Token header), or (2) the authenticated user does not have the required permission to access this resource.'
content:
application/json:
schema:
$ref: '#/components/schemas/AccessDeniedErrorDTO'
examples:
Access denied example:
summary: User lacks necessary permissions or authentication
value: "{\n \"loggedIn\": true,\n \"code\": \"access_denied\",\n \"message\": \"Access denied: you don't have necessary permissions to access this resource\",\n \"solution\": \"Contact support for appropriate permissions\"\n }"
'500':
description: 500 Internal Server Error - An unexpected error occurred on the server. The request may or may not have been processed.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorDTO'
examples:
Error - Server Error:
summary: Unexpected server error
value: "{\n \"code\": \"internal_error\",\n \"message\": \"An unexpected error occurred\",\n \"solution\": \"Please try again later or contact support\"\n }"
'429':
description: '429 Too Many Requests - API rate limit exceeded. The request has been rejected because the rate limit for this endpoint has been exceeded. Default rate limits: GET requests - 100 per 10 seconds, 500 per minute; POST/PUT/PATCH/DELETE requests - 20 per 10 seconds, 100 per minute. For increased access, please contact customer success.'
content:
application/json:
schema:
$ref: '#/components/schemas/ApiRateLimitResponse'
examples:
Rate limit exceeded example:
summary: API rate limit exceeded
value: "{\n \"error\": \"API rate limit exceeded\",\n \"message\": \"You have reached the maximum allowed requests. Please try again later or upgrade your plan for increased access\",\n \"requestLimit\": 100,\n \"requestCount\": 100,\n \"limits\": [\n {\n \"requestLimit\": 100,\n \"timeInSeconds\": 10\n },\n {\n \"requestLimit\": 500,\n \"timeInSeconds\": 60\n }\n ],\n \"currentTime\": \"2026-01-15T10:30:00\",\n \"nextResetAt\": \"2026-01-15T10:30:10\"\n }"
/public/v1/alpha/exposure/{id}/graph:
get:
tags:
- Exposure
summary: Get exposure graph by exposure analysis id
description: '**Performance impact**: Medium'
operationId: getExposureGraphById
parameters:
- name: id
in: path
required: true
schema:
type: integer
format: int32
- name: filter
in: query
required: false
schema:
$ref: '#/components/schemas/ExposureFilter'
responses:
'200':
description: OK
content:
'*/*':
schema:
$ref: '#/components/schemas/ExposureGraph'
'403':
description: '403 Forbidden - Authentication or authorization failure. This status code is returned when: (1) the request lacks valid authentication credentials (missing or invalid X-Auth-Token header), or (2) the authenticated user does not have the required permission to access this resource.'
content:
application/json:
schema:
$ref: '#/components/schemas/AccessDeniedErrorDTO'
examples:
Access denied example:
summary: User lacks necessary permissions or authentication
value: "{\n \"loggedIn\": true,\n \"code\": \"access_denied\",\n \"message\": \"Access denied: you don't have necessary permissions to access this resource\",\n \"solution\": \"Contact support for appropriate permissions\"\n }"
'500':
description: 500 Internal Server Error - An unexpected error occurred on the server. The request may or may not have been processed.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorDTO'
examples:
Error - Server Error:
summary: Unexpected server error
value: "{\n \"code\": \"internal_error\",\n \"message\": \"An unexpected error occurred\",\n \"solution\": \"Please try again later or contact support\"\n }"
'429':
description: '429 Too Many Requests - API rate limit exceeded. The request has been rejected because the rate limit for this endpoint has been exceeded. Default rate limits: GET requests - 100 per 10 seconds, 500 per minute; POST/PUT/PATCH/DELETE requests - 20 per 10 seconds, 100 per minute. For increased access, please contact customer success.'
content:
application/json:
schema:
$ref: '#/components/schemas/ApiRateLimitResponse'
examples:
Rate limit exceeded example:
summary: API rate limit exceeded
value: "{\n \"error\": \"API rate limit exceeded\",\n \"message\": \"You have reached the maximum allowed requests. Please try again later or upgrade your plan for increased access\",\n \"requestLimit\": 100,\n \"requestCount\": 100,\n \"limits\": [\n {\n \"requestLimit\": 100,\n \"timeInSeconds\": 10\n },\n {\n \"requestLimit\": 500,\n \"timeInSeconds\": 60\n }\n ],\n \"currentTime\": \"2026-01-15T10:30:00\",\n \"nextResetAt\": \"2026-01-15T10:30:10\"\n }"
components:
schemas:
ExposureReason:
required:
- name
- type
type: object
properties:
type:
type: string
enum:
- Collection
- Target
- Country
- Tariff
- ExportRestrictions
example: null
name:
type: string
example: null
example: null
TargetForeignSystemDTO:
required:
- id
- system
type: object
properties:
system:
type: string
example: null
id:
type: string
example: null
source:
type: string
nullable: true
example: null
example: null
PermissionDTO:
required:
- authority
- limits
type: object
properties:
authority:
type: string
example: null
limits:
type: object
additionalProperties:
type: integer
format: int32
example: null
description:
type: string
nullable: true
example: null
id:
type: integer
format: int32
nullable: true
example: null
example: null
InfotagTypeDTO:
required:
- active
- display
- ordering
- type
type: object
properties:
type:
type: string
example: null
active:
type: boolean
example: null
displayName:
type: string
nullable: true
example: null
icon:
type: string
nullable: true
example: null
ordering:
type: integer
format: int32
example: null
display:
type: boolean
example: null
example: null
ExposureAnalysis:
required:
- baseCollections
- collectionCommodityFilters
- commodityFilter
- customerId
- date
- exposedCollections
- exposedCountries
- id
- maxTiers
- name
- scopePrivate
- scopePublic
- scopeShared
- sourceCustomer
- sourceCustoms
- sourceMedia
- sourcePrewavePrediction
- type
type: object
properties:
id:
type: integer
format: int32
example: null
name:
type: string
example: null
baseCollections:
type: array
items:
$ref: '#/components/schemas/CollectionDTO'
example: null
date:
type: string
format: date-time
example: null
customerId:
type: integer
format: int32
example: null
type:
type: string
enum:
- Collection
- Target
- TargetList
- Country
- Alert
- Scenario
example: null
maxTiers:
type: integer
format: int32
example: null
scopePrivate:
type: boolean
example: null
scopeShared:
type: boolean
example: null
scopePublic:
type: boolean
example: null
sourceCustoms:
type: boolean
example: null
sourcePrewavePrediction:
type: boolean
example: null
sourceMedia:
type: boolean
example: null
sourceCustomer:
type: boolean
example: null
minShipments:
type: integer
format: int32
nullable: true
example: null
shipmentsPeriodFrom:
type: string
format: date
nullable: true
example: null
shipmentsPeriodTo:
type: string
format: date
nullable: true
example: null
minProbability:
type: number
format: double
nullable: true
example: null
commodityFilter:
$ref: '#/components/schemas/CommodityFilter'
collectionCommodityFilters:
type: object
additionalProperties:
$ref: '#/components/schemas/CommodityFilter'
example: null
exposedCollections:
type: array
items:
$ref: '#/components/schemas/CollectionDTO'
example: null
exposedCountries:
type: array
items:
$ref: '#/components/schemas/TargetRef'
example: null
exposedTarget:
nullable: true
allOf:
- $ref: '#/components/schemas/TargetRef'
example: null
exposedAlertId:
type: integer
format: int32
nullable: true
example: null
scenarioId:
type: integer
format: int32
nullable: true
example: null
example: null
Data:
required:
- type
type: object
properties:
type:
type: string
example: null
discriminator:
propertyName: type
example: null
InfotagDTO:
required:
- id
- isTarget
- type
type: object
properties:
id:
type: integer
format: int32
example: null
type:
$ref: '#/components/schemas/InfotagTypeDTO'
value:
type: string
nullable: true
example: null
svalue:
type: string
nullable: true
example: null
icon:
type: string
nullable: true
example: null
numValue:
type: number
nullable: true
example: null
priority:
type: string
description: Obsolete
nullable: true
deprecated: true
enum:
- Low
- Mid
- High
- Critical
example: null
impactScore:
type: string
nullable: true
enum:
- Low
- Mid
- High
- Critical
example: null
isTarget:
type: boolean
example: null
updatedAt:
type: string
format: date-time
nullable: true
example: null
example: null
InfotagGroup:
required:
- id
- name
- ordering
- sname
type: object
properties:
id:
type: integer
format: int32
example: null
name:
type: string
example: null
sname:
type: string
example: null
icon:
type: string
nullable: true
example: null
ordering:
type: integer
format: int32
example: null
example: null
CustomerData:
type: object
allOf:
- $ref: '#/components/schemas/Data'
example: null
RiskAnalysis:
required:
- approvedForReport
- collectionIds
- date
- diModel
- id
- impactT80
- isArchived
- locks
- name
- periodFrom
- periodTo
- perspective
- reason
- regularity
- riskT80
- scope
- scopingCountryShare
- targetType
- tiern
- type
type: object
properties:
id:
type: integer
format: int32
example: null
name:
type: string
example: null
perspective:
$ref: '#/components/schemas/PerspectiveDTO'
targetType:
$ref: '#/components/schemas/TargetTypeDTO'
periodFrom:
type: string
format: date
example: null
periodTo:
type: string
format: date
example: null
date:
type: string
format: date
example: null
riskT80:
type: integer
format: int32
example: null
impactT80:
type: number
format: double
example: null
diModel:
type: string
enum:
- Direct
- Parent
- Auto
example: null
locks:
type: array
items:
$ref: '#/components/schemas/RiskAnalysisLock'
example: null
isArchived:
type: boolean
example: null
regularity:
type: string
enum:
- Regular
- Adhoc
example: null
reason:
type: array
items:
type: string
enum:
- InternalDecisions
- ExternalFactors
- SubstantiatedKnowledge
- ChangeNewProducts
- ChangeNewAreas
- Other
example: null
example: null
specificOccasion:
type: string
nullable: true
example: null
approvedForReport:
type: boolean
example: null
findings:
type: string
nullable: true
example: null
scope:
type: string
enum:
- OwnBusinessArea
- Suppliers
- Customers
example: null
type:
$ref: '#/components/schemas/RiskAnalysisType'
tiern:
type: boolean
example: null
countryScoreThreshold:
type: number
format: double
nullable: true
example: null
industryScoreThreshold:
type: number
format: double
nullable: true
example: null
purchaseVolumeThreshold:
type: number
format: double
nullable: true
example: null
collectionIds:
type: array
items:
type: integer
format: int32
example: null
example: null
scopingCountryShare:
type: number
format: double
example: null
example: null
ExplorerTarget:
required:
- commodityIds
- id
- name
- tier
- weight
type: object
properties:
tier:
type: integer
format: int32
example: null
id:
type: integer
format: int32
example: null
name:
type: string
example: null
weight:
type: number
format: double
example: null
purchase:
type: number
nullable: true
example: null
nShipments:
type: integer
format: int32
nullable: true
writeOnly: true
example: null
exposedSuppliersCount:
type: integer
format: int32
nullable: true
example: null
baseSuppliersCount:
type: integer
format: int32
nullable: true
example: null
commodityIds:
type: array
items:
type: integer
format: int32
example: null
example: null
nshipments:
type: integer
format: int32
example: null
example: null
ExplorerGraph:
required:
- linkSets
- tiers
type: object
properties:
tiers:
type: array
items:
$ref: '#/components/schemas/ExplorerTier'
example: null
linkSets:
type: array
items:
$ref: '#/components/schemas/ExplorerLinkSet'
example: null
example: null
Geometry:
type: object
additionalProperties: true
description: 'GeoJSON-compatible geometry object. Fields follow the GeoJSON spec (https://geojson.org): a `type` string (e.g. `Point`, `Polygon`) and a `coordinates` array.'
example: null
ApiRateLimitResponse:
type: object
properties:
error:
type: string
description: Error type identifier
example: RateLimitExceeded
message:
type: string
description: Human-readable error message explaining the rate limit violation
example: API rate limit exceeded. Please reduce your request rate.
requestLimit:
type: integer
description: Maximum number of requests allowed in the current time window
format: int32
example: 100
requestCount:
type: integer
description: Number of requests made in the current time window
format: int32
example: 101
limits:
type: array
description: All rate limits that apply to this endpoint, showing different time windows
items:
$ref: '#/components/schemas/ApiRateLimitTimeRequestLimit'
example: null
currentTime:
type: string
description: Current server time in ISO 8601 format
format: date-time
example: '2026-01-19T10:30:00'
nextResetAt:
type: string
description: Time when the rate limit will reset in ISO 8601 format
format: date-time
example: '2026-01-19T10:30:10'
description: Response returned when API rate limit is exceeded (HTTP 429)
example: null
ExplorerLink:
required:
- from
- fromWeight
- to
- toWeight
type: object
properties:
from:
$ref: '#/components/schemas/ExplorerTargetRef'
to:
$ref:
# --- truncated at 32 KB (88 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/prewave/refs/heads/main/openapi/prewave-exposure-api-openapi.yml