MSP License Tracker API

Authentication

Generate an API key under Settings → API access. The key (prefixed mlt_live_) is shown once — store it securely. Send it as a bearer token on every request:

curl https://www.msplicensetracker.com/api/v1/tenants \
  -H "Authorization: Bearer mlt_live_xxxxxxxxxxxxxxxx"

Requests without a valid, non-revoked key receive 401. Keys can be revoked anytime from the same settings page.

Rate limits

There is no hard rate limit today. Please keep automated polling reasonable — once per minute is ample, since tenant data refreshes on a daily sync cycle. Abusive traffic may be throttled without notice.

Errors

Non-200 responses return a JSON body of the form { "error": "…" }.

Webhooks

Set a webhook URL under Settings → API access to receive an alert.created event whenever an alert fires. The request body:

{
  "event": "alert.created",
  "alert": {
    "id": "alt_x1y2z3",
    "type": "renewal_due",
    "severity": "warning",
    "title": "Microsoft 365 E3 renews in 14 days — 18 unused seats",
    "message": "Microsoft 365 E3 renews on June 5, 2026 …",
    "tenant": "Contoso Ltd",
    "createdAt": "2026-05-22T09:00:00.000Z"
  },
  "deliveredAt": "2026-05-22T09:00:01.420Z"
}

Verifying the signature

Every request carries an X-MLT-Signature header — sha256=<hmac>. Compute an HMAC-SHA256 of the raw request body using your signing secret and compare before trusting the payload:

import { createHmac, timingSafeEqual } from "crypto";

function verify(rawBody, signatureHeader, signingSecret) {
  const expected =
    "sha256=" + createHmac("sha256", signingSecret).update(rawBody).digest("hex");
  const a = Buffer.from(signatureHeader);
  const b = Buffer.from(expected);
  return a.length === b.length && timingSafeEqual(a, b);
}