Tenderen API (v1)

All endpoints are versioned under /api/v1. Requests and responses are JSON over HTTPS.

https://api.tenderen.com/api/v1

Send your API key as a Bearer token in the Authorization header. Keys are created in the app under Developers → API keys by a company Owner or Admin on the Enterprise plan. The full key is shown once; Tenderen stores only a SHA-256 hash of it. Keys can have an expiry date and can be revoked at any time.

curl "https://api.tenderen.com/api/v1/tenders?q=software&cpvCodes=72000000&limit=20" \
  -H "Authorization: Bearer $TENDEREN_API_KEY"

Scopes

Each key carries a list of scopes. New keys default to read-only (tenders:read). Calling an endpoint whose scope the key lacks returns 403 INSUFFICIENT_SCOPE.

Paths are relative to the base URL. The scope column shows the permission the key needs.

List endpoints accept page (starting at 1) and limit (1–100, default 20) and return a pagination object with page, limit, total and pages. GET /tenders also accepts q, cpvCodes and regions (comma-separated), status, source, minValue, maxValue, deadlineBefore, deadlineAfter, sort (publishedAt, deadline or estimatedValue) and order (asc or desc).

{
  "success": true,
  "data": [ { "id": "…", "title": "…", "deadline": "…" } ],
  "pagination": { "page": 1, "limit": 20, "total": 412, "pages": 21 }
}

Errors return success: false with a human-readable error and a machine-readable code.

{
  "success": false,
  "error": "Insufficient permissions. Required scope: bids:write",
  "code": "INSUFFICIENT_SCOPE"
}

Each API key may make 1,000 requests per hour by default (the limit is stored per key). Going over returns 429 RATE_LIMIT_EXCEEDED; wait for the hourly window to reset. The MCP endpoint has its own limit of 1,000 requests per hour per token.

Webhooks are part of the Enterprise plan. Events only go to endpoints that belong to the company the event concerns, and endpoints must be public https addresses.

Register an HTTPS endpoint with POST /webhooks (or under Developers → Webhooks in the app) and choose the events you want. The response contains a signing secret, shown only once; POST /webhooks/:id/rotate-secret issues a new one and POST /webhooks/:id/test sends a test event right away.

Events

• tender.new — A newly published tender matches one of your company's alerts (once per tender).
• tender.deadline — A tender in your pipeline has its submission deadline in 7, 3 or 1 days.
• tender.awarded — A contract award was published for a tender in your pipeline.
• bid.submitted — A pipeline entry moved to Submitted.
• bid.status_changed — A pipeline entry changed stage.
• alert.triggered — An alert found new matching tenders.

Verifying signatures

Every delivery is a POST with a JSON body holding id, event, createdAt and data, and the headers X-Tenderen-Event, X-Tenderen-Event-Id, X-Tenderen-Delivery and X-Tenderen-Signature. The signature header has the form t=TIMESTAMP,v1=SIGNATURE, where TIMESTAMP is in Unix seconds and SIGNATURE is the hex HMAC-SHA256 of TIMESTAMP, a dot and the raw body, keyed with your signing secret. Compare it in constant time, reject timestamps more than five minutes old, and use the event id to ignore duplicates.

import crypto from 'node:crypto';

function isValidTenderenSignature(rawBody, signatureHeader, secret) {
  const parts = Object.fromEntries((signatureHeader ?? '').split(',').map((p) => p.split('=')));
  const t = Number(parts.t);
  if (!t || Math.abs(Date.now() / 1000 - t) > 300) return false;
  const expected = crypto.createHmac('sha256', secret).update(`${t}.${rawBody}`).digest('hex');
  const a = Buffer.from(parts.v1 ?? '');
  const b = Buffer.from(expected);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

A delivery that does not get a 2xx answer within 10 seconds is retried after 1 minute, 5 minutes, 30 minutes and 2 hours; redirects are not followed. After 50 failed deliveries in a row the endpoint is turned off and its owner is notified; PATCH /webhooks/:id with active: true turns it back on. The delivery history (30 days) is available from GET /webhooks/:id/deliveries.

Tenderen runs a remote Model Context Protocol server, so AI assistants such as Claude, ChatGPT and Cursor can search tenders, assess fit, track a pipeline, draft bids and ask the tender documents on your behalf — 18 capability tools, with read access granted by default and writes, submissions and deletions as separate grants on the consent screen. Connect with OAuth (authorization code with PKCE; dynamic client registration is supported) or with an API key as a Bearer token. Tools that cannot be undone preview first and need confirmation. Every call is listed under Developers → AI connections, where connections can be tested and revoked.

MCP endpoint (Streamable HTTP)

https://tenderen.com/api/mcp

Legacy endpoint (HTTP+SSE)

https://tenderen.com/api/mcp/sse

OAuth discovery

https://tenderen.com/.well-known/oauth-authorization-server
https://tenderen.com/.well-known/oauth-protected-resource

Questions about the API or a specific integration: [email protected].

Last reviewed 4 October 2026