Core concepts

API conventions

These conventions apply across the Panic API. Individual endpoint pages remain the source of truth for request and response fields.

Environments and identifiers

Staging and production use separate base URLs, credentials, customers, subscriptions, callouts, and configuration. Treat identifiers returned by one environment as invalid in the other.

Use the canonical path casing shown in the API Reference. Most current operations use /panic-api/v2; the fixed-location CSV import/export operations retain their /v1 paths for compatibility.

Authentication

Send bearer tokens as:

1Authorization: Bearer <access-token>

Server credentials belong only in a trusted backend. Treat access tokens as opaque credentials: do not place them in logs or analytics, and do not use unverified decoded claims as proof of identity.

Content and dates

  • Send JSON with Content-Type: application/json unless the endpoint documents CSV or KML.
  • Send timestamps as ISO 8601 in UTC, for example 2026-07-24T09:30:00.000Z.
  • Do not assume numeric IDs are consecutive or portable between environments.
  • Preserve the field casing shown in the schema. Some legacy response fields, such as CancelledDate, begin with an uppercase letter.

Success and error responses

Creates, updates, and deletes commonly return 200; do not require 201 or 204 for success. Error bodies are not yet uniform, so clients should inspect message, errors, and error.

See Errors & status codes for retry and rate-limit guidance.

Retry safety

Retry transient network failures, 502, and 5xx with exponential backoff and jitter. Honour RateLimit-Reset after 429.

Do not blindly retry a create request after an ambiguous timeout. First query the resulting customer, subscription, or active callout using the identifiers available to you. Webhook consumers must be idempotent because the same event can be delivered more than once.

Compatibility

Unknown response fields should be ignored rather than treated as errors. Treat unknown callout statuses as in progress unless the status is explicitly terminal. Avoid coupling to undocumented routes or fields: they can support AURA-hosted products without being part of the public integration contract.