Overview

Federal contract opportunities, enriched, searchable, and matched to your company.

Fedwright API 1.0.0

Conventions that apply to every operation:

Errors are RFC 9457 Problem Details (application/problem+json), and every error includes traceId. Every response, errors and successes alike, carries a Server-Timing header with a trace metric, such as trace;desc=00-{trace-id}-{span-id}-01. Its trace ID is the error’s traceId, so support can find the request from either.
Lists take limit (default 50, maximum 200) and cursor, and return { items, nextCursor }. Cursors are opaque and expire after 24 hours.
Sorting uses sort, one field from each operation’s allow-list. A leading - sorts descending. Items with equal values keep a stable order across pages.
Time is ISO 8601 in UTC. A time whose source time zone was assumed comes with tzAssumed: true.
Money is { amount, currency }, with the amount as a decimal string.
Creating POST requests require Idempotency-Key, per caller (a user, machine client, or service identity), operation, and acting organization where there is one. A retry with the same key returns the original response, with Idempotent-Replayed: true, for 24 hours after it completes. A refused request keeps nothing, so it can be retried.
Conditional requests: single resources return a strong ETag. If-None-Match returns 304. PUT and PATCH require If-Match, and return 412 when it is stale.
Tenancy: another organization’s resources return 404. A missing scope returns 403 (insufficient-scope).
Rate limits are reported in RateLimit-Policy and RateLimit headers where the API answers; a 429 with a Problem comes with Retry-After. A 429 with an empty body has the X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset headers instead (see the 429 response).

Information

License: Proprietary
OpenAPI version: 3.1.1

Authentication

oauth2

Tokens come from the deployment’s OpenID Connect provider. The URLs below are relative to its issuer; clients should read the real endpoints from its discovery document (/.well-known/openid-configuration).

Browser and mobile clients use the authorization code flow with PKCE.
Machine clients use the JWT bearer grant (RFC 7523), which OpenAPI has no flow for. A machine client signs a short JWT with the private key it registered (iss and sub the machine client’s subject, which its view shows once provisioned, not its id; aud the issuer, exp at most 5 minutes ahead, and a unique jti), and posts it to the token URL below with grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer and assertion set to that JWT. It gets an access token without a refresh token. There are no client secrets.

Every client requests the API’s audience scope when it gets an access token: urn:zitadel:iam:org:project:id:{projectId}:aud, with the project ID the developer documentation gives for each environment. The scopes below are what each operation requires. Tokens don’t carry them: the API works out a caller’s scopes itself, a user’s from the client they signed in with and a machine client’s from those its organization’s owner chose for it.

Security scheme type: oauth2

Flow type: authorizationCode

Authorization URL: https://auth-staging.fedwright.com/oauth/v2/authorize

Token URL: https://auth-staging.fedwright.com/oauth/v2/token

Scopes:

ai:use - AI endpoints
alerts:manage - The caller's own alert preferences
matches:read - Matches, follows, and outcomes
matches:write - Match state, follows, and outcomes
opportunities:read - Notices, threads, changes, awards, search, reference data
org:manage - Updating the organization, members, invitations, and profile
org:read - Organization, members, and profile, for the caller's own organizations
searches:write - Saved searches

Overview

Fedwright API 1.0.0

Operations

Authentication

oauth2