> ## Documentation Index > Fetch the complete documentation index at: https://docs.dataharbor.co/llms.txt > Use this file to discover all available pages before exploring further. # REST API Delivery > Expose your Virtual APIs as REST endpoints with API key authentication. # REST API Delivery **An endpoint and a key. That's it.** The standard delivery mechanism for Virtual APIs. The current runtime exposes lease-based REST endpoints and applies your Virtual API Configuration on every request. ## Runtime endpoints | Access mode | Endpoint | Authentication | | ----------------------- | --------------------------- | ---------------------------------------------------- | | Authenticated fetch | `/fetch/{leaseId}/{target}` | `dataharbor-api-key` | | Marketplace relay | `/relay/{leaseId}/{target}` | `dataharbor-api-key: mkp_...` | | Org authorization relay | `/relay/{leaseId}/{target}` | `dataharbor-api-key: mkp_...` (authorized org's key) | `fetch` is the standard authenticated path for a Virtual API. `relay` is reserved for Virtual APIs with `Unlisted Open` or `Listed Open` visibility, and the current runtime still requires a marketplace API key on relay requests. ## Authenticated fetch Use the API key issued for your Virtual API and call the fetch endpoint with the source target appended after the lease ID: * For HTTP sources, the target is the upstream route path. * For GraphQL sources, the target is the enrolled operation ID. ### Method and body | Source / operation type | Method | Body | | -------------------------------- | --------------- | ----------------------------- | | HTTP `GET` route | `GET` | none | | HTTP `POST` route | `POST` | as configured by the source | | GraphQL operation, no variables | `GET` or `POST` | none | | GraphQL operation with variables | `POST` | `{"variables": {...}}` (JSON) | `GET` cannot carry a body, so any operation that needs variables must be invoked with `POST`. See [GraphQL Sources](../sources/graphql-sources#when-to-use-get-vs-post) for the GraphQL specifics. ### `GET` example ```bash theme={null} curl -H "dataharbor-api-key: YOUR_API_KEY" \ https://service.dataharbor.co/fetch/b097a4d3-44e6-4490-9f03-104f4d636e20/customers ``` ### `POST` example (HTTP source or GraphQL with variables) ```bash theme={null} curl -X POST \ -H "dataharbor-api-key: YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"variables":{"id":1}}' \ https://service.dataharbor.co/fetch/b097a4d3-44e6-4490-9f03-104f4d636e20/getCustomer ``` ## Marketplace relay For marketplace-visible Virtual APIs, the relay endpoint uses the same lease-based path shape but expects a marketplace key (`mkp_...`): You can create a marketplace key from the account settings page in DataHarbor. ```bash theme={null} curl -H "dataharbor-api-key: mkp_your_marketplace_key" \ https://service.dataharbor.co/relay/166d4e26-3d40-4e44-806a-e56b93ebb121/customers ``` ## Organization authorization relay When a lease owner [authorizes an organization](../core/api-access#organization-authorizations), that organization's existing marketplace key (`mkp_...`) works on the relay endpoint for the authorized Virtual API. No additional keys or auth types are needed. ```bash theme={null} curl -H "dataharbor-api-key: mkp_partner_marketplace_key" \ https://service.dataharbor.co/relay/166d4e26-3d40-4e44-806a-e56b93ebb121/customers ``` Usage counts against the **consuming organization's** marketplace quota, not the lease owner's. See [Organization Authorizations](../core/api-access#organization-authorizations) for details. ## Response shape DataHarbor preserves your upstream response shape and applies controls in order before returning the payload. ```json theme={null} [ { "id": "cust_123", "name": "Jane Doe", "email": "tok_abc123", "ssn": "" } ] ``` ### Output format via URL extension Append `.md` or `.json` to any endpoint path to request a specific output format: ```bash theme={null} # Markdown table — great for agents and quick inspection curl -H "dataharbor-api-key: YOUR_API_KEY" \ https://service.dataharbor.co/fetch/b097a4d3/customers.md # Explicit JSON (default behavior) curl -H "dataharbor-api-key: YOUR_API_KEY" \ https://service.dataharbor.co/fetch/b097a4d3/customers.json ``` If the Virtual API Configuration specifies `default_output_format`, that provides a default which can be overridden per-request via URL extension. See [Output Formatting](./output-formatting) for details. ## Request/response flow Every request passes through the governance layer: 1. **Authenticate** — Validate API key 2. **Authorize** — Check access controls (geo, IP, expiration) 3. **Fetch** — Call upstream source 4. **Normalize** — Convert upstream JSON, CSV, YAML, or Markdown into the canonical JSON model 5. **Match object** — Select the object definition for the request path 6. **Apply controls** — Run the ordered control pipeline (redact, tokenize, transform) 7. **Format** — Convert output if `default_output_format` is configured or a URL extension is present 8. **Respond** — Return governed data See [Data Pipeline](../core/data-pipeline) for the full end-to-end explanation. ## Example integration ```javascript theme={null} const response = await fetch( 'https://service.dataharbor.co/fetch/b097a4d3-44e6-4490-9f03-104f4d636e20/customers', { headers: { 'dataharbor-api-key': 'YOUR_API_KEY', 'Content-Type': 'application/json' } } ); const customers = await response.json(); // customers contains governed data with controls applied ``` ## Next steps Understand how upstream payloads are parsed before controls run Convert responses to Markdown Enable AI agent access