Delegated ecosystem access

Secure a Partner API

Partners may sell, refer, implement, operate, or integrate, but B5 remains authoritative for customer identity, security policy, licensing, entitlement, credential lifecycle, audit, evidence, and revocation.

Partner integration components

Start HereRegister partner organization, tenant relationship, projects, applications, owners, and callbacks.Open →Test ModeUse synthetic customers, orders, entitlements, and webhook events.Open →.NET APIProtect server-to-server partner calls.Open →On-premises APIConnect partner-managed private systems.Open →Developer ToolsDownload test and promotion assets.Open →

Authority boundaries

Commercial channelDirect, referral, co-sell, reseller, MSP, distributor, marketplace, or aggregator.Open →Delegated administrationBounded roles, tenants, projects, customers, and actions.Open →Licensing and entitlementOnly B5 authority issues and revokes authoritative grants.Open →Audit and evidenceEvery partner action retains actor, customer, scope, decision, and evidence identity.Open →

Implementation steps

Create partner applications with least-privilege scopes and customer boundaries.

Model delegated users and service identities separately.

Require B5-issued entitlement and licensing decisions for protected customer operations.

Sign outbound webhooks and make partner receivers idempotent.

Test cross-customer access, expired delegation, removed partner users, entitlement revocation, and incident containment.

Control details

Channel

The commercial channel changes who sells or operates the relationship, not the location of authoritative security and entitlement truth.

Delegation

Delegation is explicit, scoped, time-bound, reviewable, and revocable. A partner administrator is never a platform-wide administrator.

Entitlement

Partners can request or display entitlements, but authoritative issuance, signing, renewal, and revocation remain under B5.

Audit

Partner activity must preserve the partner organization, actor, delegated customer, application, scope, decision, correlation, and evidence references.

Partner delegation

Delegate operation without delegating authoritative truth

Partner request boundary

POST /v1/trust/decisions
X-B5-Tenant-Id: partner-tenant-id
X-B5-Application-Id: partner-application-id
X-B5-Delegated-Customer-Id: customer-tenant-id
X-B5-Key-Id: key-id
X-B5-Timestamp: 2026-06-27T12:00:00Z
X-B5-Nonce: unique-random-value
Authorization: B5-HMAC-SHA256 <signature>

C#Request signerCanonical HMAC-SHA-256 request signing.Download ↓C#Webhook verifierFreshness and constant-time signature verification.Download ↓JSONPostman collectionHealth, decision, evidence, and webhook requests.Download ↓MDPromotion checklistSecurity, evidence, and release gates.Download ↓

Partner may	B5 remains authoritative for
Refer, resell, implement, operate, or integrate within a grant	Customer identity, licensing, entitlement, credential lifecycle, audit, evidence, renewal, and revocation
Administer explicitly delegated customer resources	Cross-customer isolation, role boundaries, policy decisions, and incident containment

Developer Relations

Talk to a human.

Get architecture guidance, Test Mode access, integration review, or help choosing the right B5 identity and authorization pattern.

Contact Developer Relations Request a demo