Business Account API: provisioning, OAuth, and the resource map

This is the proposed v1 Business Account API (status: proposed, flagged for engineering confirmation; Live API today and the Business Account API roadmap maps it to the live /api/thirdparty endpoints). Everything the five Get Started steps and every product do in Brand Control Center would be available as an API, so a Business Account could be created, configured, launched, and operated programmatically, by the owner's own stack, by a partner or aggregator acting for many accounts, or by an AI agent. Base URL https://api.begenuin.com/v1; JSON in and out; every write returns the resulting resource and, where a confirmation is normally required, a proposal you approve with one call.

Getting access to a Business Account

Scopes: account:read, account:write, brand:read, brand:write, content:write, network:write, members:write, partners:write, monetize:write, reports:read, octo:act. A key or token never exceeds the role it was issued for; octo:act lets an integration raise proposals but not approve them unless it also holds the matching write scope.

curl -X POST https://api.begenuin.com/v1/oauth/token \
  -d client_id=$CLIENT_ID -d client_secret=$CLIENT_SECRET \
  -d account_id=acc_123 -d scope="brand:write network:write reports:read"

curl -X POST https://api.begenuin.com/v1/accounts \
  -H "Authorization: Bearer $PARTNER_TOKEN" \
  -d '{"company":"Northwind Health","brand":"Northwind Wellness","companyType":"consumer-services","ownerEmail":"owner@northwindhealth.example"}'

Resource map by product

Business Account & access (see Business Account API: provisioning, OAuth, and the resource map)

Brands, kit, properties & context (see Business Account API: provisioning, OAuth, and the resource map)

Network & grid (see Network: what it does and where to start)

Onsite placements & players (see Onsite: what it does and where to start)

Content, communities & Studio (see Studio: what it does and where to start)

Feeds & distribution (see Network: what it does and where to start)

Members, creators & subscriptions (see Controls: what it does and where to start)

Moderation, guidelines & brand safety (see Controls: what it does and where to start)

Partners & demand (see Monetize: what it does and where to start)

Plans, agreements, payouts & revenue (see Monetize: what it does and where to start)

Marketplace, packages & AdCP (see Marketplace: what it does and where to start)

Offsite tags, identity & attribution (see Offsite: what it does and where to start)

Octo, proposals & autonomy (see Octo: what it does and where to start)

Reports & intelligence (see Octo: what it does and where to start)

Webhooks, SDK sessions & billing (see Webhooks and events)

Conventions

• Ids are prefixed (acc_, brd_, plc_, cmt_, vid_, fd_, mbr_, prt_, agr_, prp_); list calls page with cursor and limit; filters are query parameters.
• Writes that BCC would ask you to confirm return 202 with a proposal object; POST /proposals/{proposalId}:approve applies it, :decline discards it, and a brand's autonomy setting (see Octo Autonomy and Approvals) can auto-approve a kind of change.
• Every change emits a webhook event (see Webhooks and events): proposal.created, placement.published, hub.launched, member.subscribed, partner.accepted, agreement.signed, revenue.posted, moderation.flagged.
• Rate limits: 600 requests per minute per key or token, report queries 60 per minute; X-RateLimit-Remaining on every response. Errors are JSON with code, message, docs_url.
• SDKs: the proposed @genuin/sdk (Node) and genuin (Python) server SDKs would wrap every call above with the same names used in the API & SDK block of each article; on the client, the live Web SDK 2.0.6 (see Embed the Genuin Web SDK on your website), iOS and Android SDKs 2.1.5 (see Integrate the Genuin iOS SDK and Integrate the Genuin Android SDK), React Native 3.0.3 (see Integrate the Genuin SDK with React Native apps), and Flutter (see Integrate the Genuin SDK with Flutter apps) already render the player and sign members in.

API & SDK

Access: the calls in the table are the proposed Business Account API (see Business Account API: provisioning, OAuth, and the resource map), authenticated with a key scoped to the account and a role or an OAuth client acting for it; every confirmation in this article becomes a proposal you can approve by API (POST /proposals/{proposalId}:approve). Live today, the server API under /api/thirdparty authenticates with a gn-access-token (see Generate an access token), and Live API today and the Business Account API roadmap maps what is live to what is proposed.

// proposed server SDK (Business Account API)
import { Genuin } from '@genuin/sdk';
const genuin = new Genuin({ apiKey: process.env.GENUIN_KEY });
await genuin.auth.token({ clientId, clientSecret, accountId, scope });
await genuin.accounts.create({ company, brand, companyType, ownerEmail });
await genuin.accounts.get(accountId);

Live today: Generate an access token · Environments, credentials, and test data · Embed the Genuin Web SDK on your website · Integrate the Genuin iOS SDK.

SDKs: Web SDK 2.0.6 (see Embed the Genuin Web SDK on your website), iOS SDK 2.1.5 (see Integrate the Genuin iOS SDK), Android SDK 2.1.5 (see Integrate the Genuin Android SDK), React Native 3.0.3 (see Integrate the Genuin SDK with React Native apps), and Flutter (see Integrate the Genuin SDK with Flutter apps) render Genuin and sign members in; the Node (@genuin/sdk) and Python (genuin) server SDKs are proposed with Business Account API: provisioning, OAuth, and the resource map.