Quickstart

One UAT request in Postman and one in the built-in API client.

You need: access to these docs, permission to mint an ID token as modulate-api-uat-tester@cadence-478808.iam.gserviceaccount.com (roles/iam.serviceAccountOpenIdTokenCreator), and a UAT token minted for https://uat.modulate-api.es.flute.com.

1. Mint a token

SA=modulate-api-uat-tester@cadence-478808.iam.gserviceaccount.com
AUD=https://uat.modulate-api.es.flute.com
TOKEN=$(curl -sS -X POST \
  "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${SA}:generateIdToken" \
  -H "Authorization: Bearer $(gcloud auth print-access-token)" \
  -H "Content-Type: application/json" \
  -d "{\"audience\":\"${AUD}\",\"includeEmail\":false}" \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['token'])")
echo "$TOKEN"

2. Postman

1. Method GET, URL https://uat.modulate-api.es.flute.com/api/partner/me.
2. Authorization type Bearer Token. Paste the identity token. Postman sends Authorization only.
3. Do not add X-Serverless-Authorization or an API key header.
4. Send. A registered principal returns 200 with principal_type: google_service_account.
5. Copy meta.request_id if you need to find the call in the monitor.

A 401 here is almost always a stale token, the wrong audience, or a principal that is unknown or disabled. See Errors and troubleshooting.

3. Built-in API client

Every endpoint page in the API Reference carries a test-request panel. The server list offers UAT only. Production is not a server.

1. Open the API Reference and select GET /api/partner/me.
2. In the test-request panel, choose the UAT server (https://uat.modulate-api.es.flute.com).
3. Paste the same token into the bearer-token field. The client sends it as Authorization.
4. Send the request.
5. Confirm the response identity matches the token you minted.

Live requests leave the browser from the docs origin, so that origin must be one UAT CORS allows — https://docs.modulate-api.es.flute.com or http://localhost:3000. A local preview served on any other origin cannot send them; use curl or Postman from that machine instead.

4. Health (no auth)

curl https://uat.modulate-api.es.flute.com/api/partner/health

Health is the only unauthenticated JSON route. It reports data.build so docs publication can wait for the matching UAT tag.