REST API Delivery

An endpoint and a key. That’s it. The standard delivery mechanism for Virtual APIs. The current runtime exposes lease-based REST endpoints and applies your Virtual API Configuration on every request.

Runtime endpoints

Access mode	Endpoint	Authentication
Authenticated fetch	`/fetch/{leaseId}/{target}`	`dataharbor-api-key`
Marketplace relay	`/relay/{leaseId}/{target}`	`dataharbor-api-key: mkp_...`
Org authorization relay	`/relay/{leaseId}/{target}`	`dataharbor-api-key: mkp_...` (authorized org’s key)

fetch is the standard authenticated path for a Virtual API. relay is reserved for Virtual APIs with Unlisted Open or Listed Open visibility, and the current runtime still requires a marketplace API key on relay requests.

Authenticated fetch

Use the API key issued for your Virtual API and call the fetch endpoint with the source target appended after the lease ID:

For HTTP sources, the target is the upstream route path.
For GraphQL sources, the target is the enrolled operation ID.

Method and body

Source / operation type	Method	Body
HTTP `GET` route	`GET`	none
HTTP `POST` route	`POST`	as configured by the source
GraphQL operation, no variables	`GET` or `POST`	none
GraphQL operation with variables	`POST`	`{"variables": {...}}` (JSON)

GET cannot carry a body, so any operation that needs variables must be invoked with POST. See GraphQL Sources for the GraphQL specifics.

`GET` example

curl -H "dataharbor-api-key: YOUR_API_KEY" \
  https://service.dataharbor.co/fetch/b097a4d3-44e6-4490-9f03-104f4d636e20/customers

`POST` example (HTTP source or GraphQL with variables)

curl -X POST \
  -H "dataharbor-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"variables":{"id":1}}' \
  https://service.dataharbor.co/fetch/b097a4d3-44e6-4490-9f03-104f4d636e20/getCustomer

Marketplace relay

For marketplace-visible Virtual APIs, the relay endpoint uses the same lease-based path shape but expects a marketplace key (mkp_...): You can create a marketplace key from the account settings page in DataHarbor.

curl -H "dataharbor-api-key: mkp_your_marketplace_key" \
  https://service.dataharbor.co/relay/166d4e26-3d40-4e44-806a-e56b93ebb121/customers

Organization authorization relay

When a lease owner authorizes an organization, that organization’s existing marketplace key (mkp_...) works on the relay endpoint for the authorized Virtual API. No additional keys or auth types are needed.

curl -H "dataharbor-api-key: mkp_partner_marketplace_key" \
  https://service.dataharbor.co/relay/166d4e26-3d40-4e44-806a-e56b93ebb121/customers

Usage counts against the consuming organization’s marketplace quota, not the lease owner’s. See Organization Authorizations for details.

Response shape

DataHarbor preserves your upstream response shape and applies controls in order before returning the payload.

[
  {
    "id": "cust_123",
    "name": "Jane Doe",
    "email": "tok_abc123",
    "ssn": ""
  }
]

Output format via URL extension

Append .md or .json to any endpoint path to request a specific output format:

# Markdown table — great for agents and quick inspection
curl -H "dataharbor-api-key: YOUR_API_KEY" \
  https://service.dataharbor.co/fetch/b097a4d3/customers.md

# Explicit JSON (default behavior)
curl -H "dataharbor-api-key: YOUR_API_KEY" \
  https://service.dataharbor.co/fetch/b097a4d3/customers.json

If the Virtual API Configuration specifies default_output_format, that provides a default which can be overridden per-request via URL extension. See Output Formatting for details.

Request/response flow

Every request passes through the governance layer:

Authenticate — Validate API key
Authorize — Check access controls (geo, IP, expiration)
Fetch — Call upstream source
Normalize — Convert upstream JSON, CSV, YAML, or Markdown into the canonical JSON model
Match object — Select the object definition for the request path
Apply controls — Run the ordered control pipeline (redact, tokenize, transform)
Format — Convert output if default_output_format is configured or a URL extension is present
Respond — Return governed data

See Data Pipeline for the full end-to-end explanation.

Example integration

const response = await fetch(
  'https://service.dataharbor.co/fetch/b097a4d3-44e6-4490-9f03-104f4d636e20/customers',
  {
    headers: {
      'dataharbor-api-key': 'YOUR_API_KEY',
      'Content-Type': 'application/json'
    }
  }
);

const customers = await response.json();
// customers contains governed data with controls applied

Next steps

Input Normalization

Understand how upstream payloads are parsed before controls run

Output Formatting

Convert responses to Markdown

MCP Server Delivery

Enable AI agent access

​REST API Delivery

​Runtime endpoints

​Authenticated fetch

​Method and body

​GET example

​POST example (HTTP source or GraphQL with variables)

​Marketplace relay

​Organization authorization relay

​Response shape

​Output format via URL extension

​Request/response flow

​Example integration

​Next steps