Marketplace API — Fifth Third reference

The marketplace API exposes entitlement, provisioning and audit-log operations under the /v1/fifth-third/ path. Authentication is a workspace-scoped JWT signed with the Fifth Third release key.

Base URL

https://api.fifththirdstore.org/v1/fifth-third/

Authentication

Every request carries an Authorization: Bearer <jwt> header. The JWT is signed with the current Fifth Third release key and expires after fifteen minutes. Refresh through /v1/fifth-third/tokens/refresh.

Endpoints

• GET /entitlement — returns the list of Fifth Third modules provisioned to the workspace and the current seat map.
• POST /provisioning — provisions a module or updates the entitlement for an existing one. Body: { module_id, seats, batch }.
• GET /audit-log?since=YYYY-MM-DD — returns the workspace audit log entries since the given date. One entry per install, update or unenrolment.
• GET /manifest/<batch> — returns the signed batch manifest for a given Fifth Third batch (v1, v2, v3, v4).
• POST /subject-rights — files a GDPR subject-rights request. Body: { subject_email, right, note }.
• GET /health — unauthenticated liveness probe.

Rate limits

120 rpm on Fifth Third Solo, 600 rpm on Fifth Third Studio, 3,000 rpm on Fifth Third Fleet. Bursts up to 3× the rate are tolerated for 60 seconds.

Errors

Standard 4xx/5xx codes with a JSON body: { error, message, docs_url }. Every error links to the corresponding documentation section.

A machine-readable OpenAPI spec is served at /docs/marketplace-api/openapi.yaml.