Arkestro

aid: arkestro
name: Arkestro
description: Arkestro is a predictive procurement orchestration platform for enterprise sourcing teams, applying negotiation
  science, supplier science and process science to run competitive sourcing events at scale. The platform covers sourcing
  events and their schedules, supplier organizations and contacts, corporate item and category catalogs, purchase orders,
  document and quote submissions, awards, and event analytics. It serves automotive, oil and gas, high-tech manufacturing,
  construction, financial services and food and beverage buyers. Arkestro publishes a public OpenAPI 3.1.1 contract for its
  API V2 at api.arkestro.com and operates an OAuth 2.1 remote MCP server, though its developer documentation portal sits behind
  a customer sign-in wall.
deliveryModel:
  model: saas
  open_source: false
  commercial: true
  callable_host: true
  label: Hosted service · you call their endpoint
  confidence: high
  source:
  - openapi
  - pricing
  generated: '2026-08-28'
  method: derived
accessModel:
  pricing: unknown
  onboarding: unknown
  trial: false
  try_now: false
  public: false
  label: Unknown
  confidence: low
  source:
  - authentication
  - scopes
  - security
  generated: '2026-11-06'
  method: derived
image: https://arkestro.com/wp-content/uploads/arkestro_logo_featured_default.jpg
url: https://raw.githubusercontent.com/api-evangelist/arkestro/refs/heads/main/apis.yml
x-type: company
x-source: harvest:secondary-market
specificationVersion: '0.23'
created: '2026-08-06'
modified: '2026-08-06'
tags:
- Procurement
- Sourcing
- Supply Chain
- Spend Management
- eSourcing
- Supplier Management
- Purchase Orders
- procurement-analytics
- Enterprise Software
- predictive-procurement
- MCP
- Webhook
tags_raw:
- procurement
- sourcing
- supply-chain
- spend-management
- e-sourcing
- supplier-management
- purchase-orders
- procurement-analytics
- enterprise-software
- predictive-procurement
- mcp
- webhooks
apis:
- name: Arkestro MCP Server
  description: Remote Model Context Protocol server operated by Arkestro, authorized with OAuth 2.1 authorization code flow
    and mandatory PKCE S256 against the mcp:read, mcp:write and offline_access scopes. The endpoint is live but undocumented
    on any public Arkestro page and its tools/list is authorization-gated, so the tool set is not publicly enumerable.
  humanURL: https://api.arkestro.com/.well-known/oauth-authorization-server
  baseURL: https://api.arkestro.com/api/v2/mcp
  tags:
  - MCP
  - Procurement
  - Agent-Native
  tags_raw:
  - mcp
  - procurement
  - agent-native
  properties:
  - type: MCPServer
    url: mcp/arkestro-mcp.yml
  - type: ToolCrosswalk
    url: mcp/arkestro-tool-crosswalk.yml
  - type: OAuthScopes
    url: scopes/arkestro-scopes.yml
  - type: Authentication
    url: authentication/arkestro-authentication.yml
- aid: arkestro:arkestro-webhooks-api
  name: Arkestro Webhooks API
  description: "# Verifying webhook signatures\n\nArkestro signs **every** outbound webhook with **HMAC-SHA256**. The instructions\n\
    below apply to all webhook events. Before you trust a delivery, verify the\nsignature so you can be sure the request came\
    \ from Arkestro and was not tampered\nwith in transit.\n\n## Headers\n\nEvery delivery includes these headers:\n\n| Header\
    \ | Description |\n| --- | --- |\n| `X-Arkestro-Signature` | One or more HMAC-SHA256 signatures of the request, each formatted\
    \ `sha256=<hex>` and joined by commas with no whitespace (e.g. `sha256=5d61...,sha256=9af2...`). Multiple values appear\
    \ during secret rotation — see below. |\n| `X-Arkestro-Timestamp` | The Unix timestamp (epoch **seconds**, as a string)\
    \ at which the request was signed, e.g. `1748290800`. This value is part of the signed payload. |\n| `X-Arkestro-Idempotency-Key`\
    \ | A UUID identifying the delivery **event**. It is generated once when the event fires and stays **constant across all\
    \ retry attempts** of that delivery, so you can use it to deduplicate retries on your end. Unlike `request_id` in the\
    \ body, which changes on every attempt, this value does not. It is **not** part of the signed payload. |\n\n## How the\
    \ signature is computed\n\nArkestro builds a **signed payload** by concatenating the timestamp, a literal\n`.`, and the\
    \ raw request body:\n\n```text\nsigned_payload = \"{X-Arkestro-Timestamp}.{raw_request_body}\"\n```\n\nIt then computes\
    \ `HMAC-SHA256(secret, signed_payload)` as a lowercase **hex**\ndigest and prefixes it with `sha256=`. Folding the timestamp\
    \ into the digest\nmeans a replayed request with a tampered timestamp will fail verification.\n\n## How to verify a delivery\n\
    \n1. Read the `X-Arkestro-Timestamp` and `X-Arkestro-Signature` headers.\n2. *(Recommended)* Reject the delivery if the\
    \ timestamp is outside a tolerance\n   window (e.g. ±5 minutes from now) to limit replay attacks.\n3. Rebuild the signed\
    \ payload as `\"{timestamp}.{raw_body}\"` using the **raw\n   request bytes** — not a re-serialized or pretty-printed\
    \ copy of the JSON.\n   Re-encoding the body will change the bytes and break verification.\n4. Compute `sha256=` + the\
    \ hex HMAC-SHA256 of the signed payload using your\n   signing secret.\n5. Split `X-Arkestro-Signature` on `,` and check,\
    \ using a **constant-time**\n   comparison, whether your computed value matches any of the provided values.\n   Accept\
    \ the delivery if at least one matches.\n\n## Secret rotation and multiple signatures\n\n`X-Arkestro-Signature` can contain\
    \ **more than one** `sha256=` value. Arkestro\nsigns each delivery with every secret that is currently active, including\
    \ a\nprevious secret that is still within its rotation grace period.\n\nThis lets you rotate secrets with zero missed\
    \ deliveries:\n\n- While both the old and new secret are active, Arkestro sends a signature for\n  each. A verifier holding\
    \ either secret will find a matching value.\n- Once you have switched to the new secret and the old one expires, only\
    \ the new\n  signature is sent.\n\nWhen verifying, always **split the header on commas and accept if any value\nmatches**\
    \ a digest computed with any secret you currently hold. Never assume a\nsingle signature.\n\n## Code examples\n\nEach\
    \ example reads the raw request body, rebuilds the signed payload, splits the\nsignature header on commas, and compares\
    \ each candidate against a locally\ncomputed digest using a constant-time comparison. `secrets` is the list of\nsigning\
    \ secrets you currently hold (one normally, two during a rotation).\n\n### Node.js\n\n```js\nconst crypto = require('crypto');\n\
    \n// rawBody must be the exact bytes received (e.g. a string or Buffer),\n// not JSON.parse'd and re-stringified.\nfunction\
    \ verifyWebhook(rawBody, headers, secrets, toleranceSec = 300) {\n  const timestamp = headers['x-arkestro-timestamp'];\n\
    \  const signatureHeader = headers['x-arkestro-signature'];\n  if (!timestamp || !signatureHeader) return false;\n\n \
    \ // Optional replay protection.\n  const age = Math.floor(Date.now() / 1000) - Number(timestamp);\n  if (!Number.isFinite(age)\
    \ || Math.abs(age) > toleranceSec) return false;\n\n  const signedPayload = `${timestamp}.${rawBody}`;\n  const provided\
    \ = signatureHeader.split(',');\n\n  return secrets.some((secret) => {\n    const expected =\n      'sha256=' +\n    \
    \  crypto.createHmac('sha256', secret).update(signedPayload, 'utf8').digest('hex');\n    const expectedBuf = Buffer.from(expected);\n\
    \n    return provided.some((candidate) => {\n      const candidateBuf = Buffer.from(candidate);\n      return (\n    \
    \    candidateBuf.length === expectedBuf.length &&\n        crypto.timingSafeEqual(candidateBuf, expectedBuf)\n      );\n\
    \    });\n  });\n}\n```\n\n### Python\n\n```python\nimport hashlib\nimport hmac\nimport time\n\n\ndef verify_webhook(raw_body:\
    \ bytes, headers, secrets, tolerance_sec: int = 300) -> bool:\n    timestamp = headers.get(\"X-Arkestro-Timestamp\")\n\
    \    signature_header = headers.get(\"X-Arkestro-Signature\")\n    if not timestamp or not signature_header:\n       \
    \ return False\n\n    # Optional replay protection. Fail closed on a malformed timestamp header.\n    try:\n        age\
    \ = abs(int(time.time()) - int(timestamp))\n    except (TypeError, ValueError):\n        return False\n    if age > tolerance_sec:\n\
    \        return False\n\n    # raw_body must be the exact bytes received.\n    signed_payload = f\"{timestamp}.\".encode()\
    \ + raw_body\n    provided = signature_header.split(\",\")\n\n    for secret in secrets:\n        digest = hmac.new(secret.encode(),\
    \ signed_payload, hashlib.sha256).hexdigest()\n        expected = f\"sha256={digest}\"\n        if any(hmac.compare_digest(expected,\
    \ candidate) for candidate in provided):\n            return True\n    return False\n```\n\n### Ruby\n\n```ruby\nrequire\
    \ \"openssl\"\nrequire \"active_support/security_utils\"\n\n# raw_body must be the exact request body string received\
    \ (e.g. request.raw_post).\ndef verify_webhook(raw_body, headers, secrets, tolerance_sec: 300)\n  timestamp = headers[\"\
    X-Arkestro-Timestamp\"]\n  signature_header = headers[\"X-Arkestro-Signature\"]\n  return false if timestamp.nil? || signature_header.nil?\n\
    \n  # Optional replay protection.\n  return false if (Time.now.to_i - timestamp.to_i).abs > tolerance_sec\n\n  signed_payload\
    \ = \"#{timestamp}.#{raw_body}\"\n  provided = signature_header.split(\",\")\n\n  secrets.any? do |secret|\n    digest\
    \ = OpenSSL::HMAC.hexdigest(\"sha256\", secret, signed_payload)\n    expected = \"sha256=#{digest}\"\n    provided.any?\
    \ { |candidate| ActiveSupport::SecurityUtils.secure_compare(expected, candidate) }\n  end\nend\n```\n\n# Responding to\
    \ a delivery\n\nYour endpoint's HTTP response tells Arkestro whether the delivery succeeded.\n\n- **Acknowledge with a\
    \ `2xx` status code.** Any `2xx` (e.g. `200`, `201`, `202`,\n  `204`) is treated identically as success. The response\
    \ body is ignored.\n- **Respond promptly.** Arkestro waits up to **10 seconds** for a response. Do any\n  slow processing\
    \ asynchronously (enqueue it and return `2xx` right away) so you\n  don't exceed the timeout.\n- **Anything else is a\
    \ failed delivery.** A non-`2xx` status code, a timeout, or a\n  connection error is treated as a failure. Whether Arkestro\
    \ retries depends on the\n  status code — see the retry schedule below. In particular, `4xx` errors (except\n  `429`)\
    \ are treated as permanent failures and will **not** be retried.\n\n## Retry schedule\n\nArkestro retries failed deliveries\
    \ automatically. The retry behavior depends on the\nfailure type.\n\n**What gets retried:** `429`, `5xx`, transport errors\
    \ (timeouts, connection failures).\n\n**What is not retried (delivery is discarded):** `4xx` (except `429`).\n\nArkestro\
    \ makes up to **10 retry attempts** using exponential backoff. If all\nattempts are exhausted without a `2xx` response,\
    \ the delivery is permanently\nabandoned. The final retry occurs approximately **4–5 hours** after the initial\nattempt."
  humanURL: https://api.arkestro.com/.well-known/oauth-authorization-server
  baseURL: https://api.arkestro.com/api/v2/mcp
  tags:
  - Webhook
  tags_raw:
  - Webhooks
  properties:
  - type: OpenAPI
    url: openapi/arkestro-webhooks-api-openapi.yml
  - type: APIReference
    url: https://api.arkestro.com/api-docs
  - type: Documentation
    url: https://api.arkestro.com/api-docs
  - type: Authentication
    url: authentication/arkestro-authentication.yml
  - type: Conventions
    url: conventions/arkestro-conventions.yml
  - type: ErrorCatalog
    url: errors/arkestro-problem-types.yml
  - type: DataModel
    url: data-model/arkestro-data-model.yml
  - type: Webhooks
    url: asyncapi/arkestro-webhooks.yml
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com
- FN: APIs.json
  email: info@apis.io
common:
- type: CapabilityMap
  url: capabilities/arkestro-capability-edges.yml
  name: Arkestro Business Capability Map
- type: Website
  url: https://arkestro.com/
- type: Documentation
  url: https://api.arkestro.com/api-docs
- type: APIReference
  url: https://api.arkestro.com/api-docs
- type: DeveloperPortal
  url: https://developer.arkestro.com/
- type: Login
  url: https://app.arkestro.com/login
- type: Support
  url: https://arkestro.com/contact-us/
- type: Blog
  url: https://arkestro.com/blog/
- type: GitHubOrganization
  url: https://github.com/bid-ops-development
- type: TermsOfService
  url: https://arkestro.com/terms-of-use/
- type: PrivacyPolicy
  url: https://arkestro.com/privacy-policy/
- type: StatusPage
  url: https://www.arkestrostatus.com/
- type: Compliance
  url: https://arkestro.com/security/
- type: TrustCenter
  url: security/arkestro-trust-center.yml
- type: Webhooks
  url: asyncapi/arkestro-webhooks.yml
- type: MCPServer
  url: mcp/arkestro-mcp.yml
- type: OAuthScopes
  url: scopes/arkestro-scopes.yml
- type: Authentication
  url: authentication/arkestro-authentication.yml
- type: Conventions
  url: conventions/arkestro-conventions.yml
- type: ErrorCatalog
  url: errors/arkestro-problem-types.yml
- type: Lifecycle
  url: lifecycle/arkestro-lifecycle.yml
- type: Conformance
  url: conformance/arkestro-conformance.yml
- type: DataModel
  url: data-model/arkestro-data-model.yml
- type: WellKnown
  url: well-known/arkestro-well-known.yml
- type: Packages
  url: packages/arkestro-packages.yml
- type: LLMsTxt
  url: llms/arkestro-llms.txt
- type: AgentSkill
  url: skills/_index.yml
- type: AgenticAccess
  url: agentic-access/arkestro-agentic-access.yml
- type: DomainSecurity
  url: security/arkestro-domain-security.yml
- type: Overlay
  url: overlays/arkestro-api-v2-overlay.yaml
- type: ToolCrosswalk
  url: mcp/arkestro-tool-crosswalk.yml
x-enrichment:
  date: '2026-08-06'
  status: enriched
  artifacts_added: 24
  pass: local-v1