Enterprise Delivery API
The Enterprise Delivery API add-on unlocks programmatic access to your platform. It is for teams doing volume: syncing catalog into their own systems, automating repetitive delivery work, feeding a BI dashboard, or connecting a partner portal.
Once active, credentials are created at Settings > DDEX Gateway.
Do you need it?
You probably do if you are:
- Moving more releases per week than a person wants to click through
- Keeping catalog or delivery status in sync with a system you already run
- Feeding sales and analytics into finance or BI tooling
- Building a partner-facing portal on top of your platform
You probably do not if the dashboard covers your workflow today. Nothing is lost by waiting until volume justifies it.
Creating credentials
Open Settings > DDEX Gateway. The API access panel shows whether credentials exist, the token exchange path, the token lifetime, and which capabilities are enabled.
Select Create API credentials. Creating and rotating is always an explicit action, never automatic.
Copy the API key and the API secret immediately. The secret is shown once and cannot be retrieved afterwards.
Store both in your secret manager. Never in a browser, a spreadsheet, a shared document, or a chat message.
Confirm the capabilities match what the integration actually does, then hand your developer the Quickstart.
How access works
Your integration exchanges the key and secret for a bearer token, then sends that token on every request. Tokens always expire. The default lifetime is one hour, and you can configure anywhere from 5 minutes to 24 hours.
New credentials start with read-only catalog access. Everything beyond that is granted deliberately.
| Area | What it covers |
|---|---|
| Catalog | Artists, releases, tracks, splits, smartlinks, and reference data |
| Account | Account settings and labels |
| Billing | Subscriptions, orders, packages, and upgrades |
| Branding | Theme and email theme configuration |
| Users | Your customer accounts |
| Members | Staff, roles, and permissions |
| Release review | The review and processing queue |
| Copyright | Copyright records and wallet |
| DDEX | DDEX read, write, and manage |
| Webhooks | Webhook configuration |
Full endpoint detail is in the Delivery API reference. Reporting data has its own Reports API.
Add-ons that gate API areas
Some groups need their product add-on active as well. Member endpoints, for example, require both this add-on and Team Members. Without both, those calls return an add-on access error even though the credential itself is valid.
Running it safely
One credential per system. Sharing one credential between your BI tool and your partner portal means you cannot revoke one without breaking the other, and you cannot tell them apart in the audit trail.
Grant the narrowest capability set. A reporting sync does not need write access to your catalog.
Rotate on people changes. When whoever set up an integration leaves, rotate. Rotation revokes every existing bearer token immediately, so schedule it rather than doing it mid-day.
Use it for repeatable work. One-off manual changes belong in the dashboard, where they are attributable to a person.
If it is lost, the only recovery is rotating the credentials, which immediately invalidates every token issued from the old pair. Capture it into your secret manager at the moment you create it.
Common questions
Is this a subscription? It is licensed as a one-time purchase for your workspace. Check the Addons page for the terms that apply to you.
Can I test without touching live data? Yes. See Staging Environment.
Do API permissions follow my staff roles? API clients carry their own capabilities. Where an integration acts on behalf of one of your customers, that supplies ownership context, not extra authority. See Acting for Users.
What does a 403 mean? A permission or capability failure, not a missing endpoint. Check the credential's capabilities first, then whether a gating add-on is active. See Troubleshooting.
Next
Was this page helpful?