> For the complete documentation index, see [llms.txt](https://docs.orbitfin.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.orbitfin.ai/orbit-api-reference/api/orbit-api-setup.md).

# Orbit API Setup

### 1. Overview <a href="#heading-17e4230e-4444-4c7c-bcc1-f83210b378ef--1-overview-0" id="heading-17e4230e-4444-4c7c-bcc1-f83210b378ef--1-overview-0"></a>

Orbit exposes two access channels, both of which require authentication:

* **REST API** — for backend services, data pipelines, and batch jobs.

To support both machine-to-machine integrations and end-user delegated access, Orbit supports **two authentication methods**:

<table><thead><tr><th>Method</th><th>Channels</th><th>Typical Use Cases</th><th data-hidden></th></tr></thead><tbody><tr><td><strong>API Key</strong></td><td>REST API </td><td>Server-to-server calls, individual developers, trusted internal environments</td><td></td></tr></tbody></table>

### 2. Base URLs & Interactive References <a href="#heading-f20e82ae-0d17-4395-8fc6-21abfe6b1b51--20-base-urls-interactive-references-0" id="heading-f20e82ae-0d17-4395-8fc6-21abfe6b1b51--20-base-urls-interactive-references-0"></a>

Before issuing any request, make sure you are calling the correct endpoint. Orbit exposes two independent services, each with its own base URL and interactive documentation:

| Service      | Base URL                  | Interactive Reference                                                       | Description                                                                                                                             |
| ------------ | ------------------------- | --------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
| **REST API** | `https://api.orbitfin.ai` | `https://api.orbitfin.ai/docs` [<sup>1</sup>](https://api.orbitfin.ai/docs) | RESTful endpoints for programmatic access — entity lookup, report retrieval, file download, PDF parsing, news, EOD price, Chat AI, etc. |

This API Reference describes the RESTful and realtime APIs you can use to interact with the Orbit platform. REST APIs are usable via HTTP in any environment that supports HTTP requests.

**Quick Reference**

**REST API**

```
<HTTP>
Base URL:         https://api.orbitfin.ai      
OpenAPI / Docs:   https://api.orbitfin.ai/docs
Auth Header:      X-API-KEY: <your-api-key>
Versioning:       /v1/...   (e.g. /v1/company_report/file_list)
Content-Type:     application/json
```

**Minimal Smoke Tests**

Verify your key works against each surface in under 10 seconds.

**REST API — list files for a report**

```
curl -X POST 'https://api.orbitfin.ai/v1/company_report/file_list' \
  -H 'accept: application/json' \
  -H 'X-API-KEY: <your-api-key>' \
  -H 'Content-Type: application/json' \
  -d '{
        "report_id": ["f_haBmMwT4WN7tXrt8rj9eA3"],
        "option": ["pdf"]
      }'
```

Obtain different types of file information based on a list of report IDs and query options.

Full request/response schemas and a live "Try it out" console are available in the API Playground [<sup>1</sup>](https://api.orbitfin.ai/docs).

**Unified Billing Across Both Surfaces**

API Key usage on either surface draws from the **same credit pool** on your Orbit account:

Universal Currency: Same credits work for both APIs and MCP · APIs: Direct programmatic access charges credits per operation · MCP: Natural language queries consume credits based on complexity · Shared Pool: API and MCP usage draws from the same credit balance

. There is no need to provision separate quotas — a single API key (or a single OAuth-authenticated user, see §3) is billed uniformly.

<br>

### 3. Method 1: API Key Authentication <a href="#heading-17e4230e-4444-4c7c-bcc1-f83210b378ef--2-method-1-api-key-authentication-0" id="heading-17e4230e-4444-4c7c-bcc1-f83210b378ef--2-method-1-api-key-authentication-0"></a>

1. Sign in to the Orbit Console\[<https://insight.orbitfin.ai/>] → **Settings → API Keys**.

<figure><img src="/files/Q2qQEI3se4Oq8e2XVL7h" alt=""><figcaption></figcaption></figure>

2. Click **Create API Key**, give it a name, and save.

#### 3.2 Using API Key with the REST API <a href="#heading-17e4230e-4444-4c7c-bcc1-f83210b378ef--22-using-api-key-with-the-rest-api-0" id="heading-17e4230e-4444-4c7c-bcc1-f83210b378ef--22-using-api-key-with-the-rest-api-0"></a>

Pass the key in the `X-API-KEY` header:

**\<BASH>**

```
curl -X POST 'https://api.orbitfin.ai/v1/company_report/file_list' \
  -H 'accept: application/json' \
  -H 'X-API-KEY: <your-api-key>' \
  -H 'Content-Type: application/json' \
  -d '{
        "report_id": ["f_haBmMwT4WN7tXrt8rj9eA3"],
        "option": ["pdf"]
      }'
```

#### 3.4 Security Best Practices <a href="#heading-17e4230e-4444-4c7c-bcc1-f83210b378ef--24-security-best-practices-0" id="heading-17e4230e-4444-4c7c-bcc1-f83210b378ef--24-security-best-practices-0"></a>

API keys are long-lived credentials that do not carry user identity, which makes per-user authorization difficult and creates significant risk if leaked into logs or version control; audit trails can only record what an API key did, not which user.

Therefore:

* **Never** embed API keys in frontend code.
* **Never** commit them to Git.
* **Rotate** keys regularly.
* Follow the **principle of least privilege** when assigning scopes (where supported).