Skip to documentation

OPEN API
Data Exchange
Documentation

A centralized data-exchange gateway for B2B partner integrations. Every endpoint accepts a secure HTTPS POST payload, is authorized with a CamDigiKey access token, and returns a predictable JSON envelope.

Endpoints
13
Transport
HTTPS / JSON
Auth
CamDigiKey
Rate limit
60 / min
Your first request 
curl -X POST https://yourservice.com/open-api/v1/services \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"keyword": "", "page": 0, "size": 20}'

Getting started

Two things apply to every call in this reference: the base URL you prefix onto each route, and three headers you send with each request.

Base URL

Prefix every route below with this address. Routes are listed without it.

https://yourservice.com/open-api/v1

Requests are accepted over TLS only, and every route uses POST — there are no GET variants. Begin with /services to resolve the service codes the other endpoints expect.

Required headers

Send your CamDigiKey access token as described in Authentication. Endpoints marked Public do not need Authorization.

Authorization
Bearer {CAMDIGIKEY_ACCESS_TOKEN}
Accept
application/json
Content-Type
application/json

Response envelope

Every endpoint answers with the same three top-level keys, so you can write one handler for all of them. Check code, not the HTTP status. The exceptions are HTTP 401 (rejected token) and 429 (rate limit), which return before the endpoint runs. 

{
  "code": 0,
  "message": "Successfully",
  "data": { ... }
}
0
Request succeeded.
400
No matching record found.
422
Validation failed; data.errors lists each field.
500
Unexpected server error; retry later.

Authentication

Protected endpoints are authorized with a CamDigiKey access token. The gateway does not issue tokens itself: sign the user in with CamDigiKey, then forward the access token you receive. Each request is checked against the CamDigiKey service before it reaches the data.

1. Send the CamDigiKey access token

Put the token in the Authorization header. If you cannot set headers, pass it as the accessToken query parameter instead.

POST /open-api/v1/applications 
curl -X POST https://yourservice.com/open-api/v1/applications \
  -H "Authorization: Bearer {CAMDIGIKEY_ACCESS_TOKEN}" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{"service_codes": [], "application_statuses": [], "application_types": [], "keyword": ""}'

2. Handle a rejected token

A missing, expired, or invalid token is rejected before the endpoint runs, with HTTP 401. This response does not use the standard envelope. Get a fresh token from CamDigiKey and retry. If the CamDigiKey service itself cannot be reached, the gateway answers 503 instead; keep your token and retry later.

401 Unauthorized 
{
  "message": "Unauthorized",
  "errors": {
    "accessToken": ["Invalid authorization."]
  }
}
Token issuer
CamDigiKey
Token location
Authorization header or ?accessToken=
Protected endpoints
11
Public endpoints
/services, /lcps/verification/business-activity

Rate limits

Every endpoint, public or protected, allows 60 requests per minute per client IP address. Failed authorization attempts count toward the limit. Each response reports your remaining allowance in its headers.

X-RateLimit-Limit
Requests allowed per minute.
X-RateLimit-Remaining
Requests left in the current window.
Retry-After
Seconds to wait, sent with a 429.
HTTP/1.1 429 Too Many Requests
Retry-After: 42

{
  "message": "Too Many Attempts."
}

Application processing

Search submitted applications, open a single record, pull its attached documents, and read its status history.

POST /applications CamDigiKey

Search applications across the services your partnership covers.

Required
service_codes[] application_statuses[] application_types[] keyword
Optional
page size sort
POST /applications/info CamDigiKey

Retrieve the full detail record for one application.

Required
application_id
Optional
None
POST /applications/documents CamDigiKey

Download one document attached to an application.

Required
application_id document_id
Optional
None
POST /applications/info/histories CamDigiKey

List every status change recorded against an application.

Required
application_id
Optional
None
POST /applications/statistics CamDigiKey

Aggregate application counts by service, status, and type.

Required
service_codes[] application_statuses[] application_types[]
Optional
from_date to_date page size

Profile & customer LCP management

Look up issued profiles and their documents, resolve a customer LCP record, and verify a registered business activity.

POST /lcps CamDigiKey

Search issued LCPs by service, status, and issue or expiry window.

Required
service_codes[] lcp_statuses[] keyword issued_date expired_date
Optional
created_from_date created_to_date updated_from_date updated_to_date page size sort
POST /lcps/info CamDigiKey

Retrieve the full detail record for one LCP.

Required
lcp_id
Optional
None
POST /lcps/documents CamDigiKey

Download one document attached to an LCP.

Required
lcp_id document_id
Optional
None
POST /lcp/printed/info CamDigiKey

Retrieve a customer LCP profile record.

Required
lcp_id
Optional
None
POST /profile/lcp/documents CamDigiKey

Download an LCP document identified by taxpayer and licence details.

Required
service_code single_id id_number tin lcp_id document_type
Optional
None
POST /lcps/statistics CamDigiKey

Aggregate LCP counts by service and status.

Required
service_codes[] lcp_statuses[]
Optional
from_date to_date page size sort
POST /lcps/verification/business-activity Public

Confirm a business activity against the registered record.

Required
single_id tin
Optional
None

Core system utilities

Resolve the service catalogue. Start here: the service codes returned by this endpoint are the values every other request expects.

POST /services Public

List available services with their codes, English and Khmer names, and type.

Required
None
Optional
keyword page size sort