Skip to main content

​
Authentication

For server-to-server integrations, generate an API key from Settings → Account Settings → Developer Settings in the Gratona dashboard. Send the key in the X-HYS-API-Key header on protected admin requests:
Protected admin endpoints also accept Passport access tokens through Authorization: Bearer <token>. These are alternative authentication methods; one valid credential is sufficient. Access is limited to the key or token’s organization and the user’s permissions. Public endpoints do not require an admin API key. Donor, recipient, and participant portal endpoints have their own sign-in and session requirements. Follow each endpoint’s parameters and authentication description; an admin API key does not replace a portal session.

​
API Versions

Most operations use https://api.gratona.com/v1. The v2 notes API uses /v2, and public endpoints mounted outside a version prefix use the root API URL. Each endpoint’s generated request example includes its correct base URL. The continuing api.helpyousponsor.com host supports compatibility integrations. The X-HYS-API-Key header remains the API-key header on both hosts.

​
Requests And Responses

Use the method, path, content type, and required fields shown for each operation. Mutations may require a preview token or an idempotency key. A 202 Accepted response means work was queued; use the documented status endpoint to observe completion. Retired operations are marked deprecated and may return 410 Gone. This reference is generated from controller annotations in the Gratona API repository. Examples describe the API contract; use test data when trying operations that create or change records.