Authentication

All requests authenticate using an API key sent in the X-API-Key header.

curl https://api.burodeingresos.com/verifications \
  -H "X-API-Key: your-api-key" \
  -H "Content-Type: application/json"

Manage your API keys from the Developers section in console.burodeingresos.com. Keep your API key secret. Never commit it to source control, expose it in client-side code, or share it across teams.

API Keys rotation (zero-downtime)

You can have multiple active API keys simultaneously to rotate keys without
service interruptions:

1. Create a new key in the Developers section of the console with a descriptive label.
2. Copy and store the secret immediately. For security reasons, the full secret is shown only once and cannot be retrieved later.
3. Deploy the new key to your application or environment.
4. Verify traffic cutover by checking the Last used timestamp of the previous key in the console.
5. Revoke the previous key once you confirm it is no longer receiving traffic.

Transport security

All Buró de Ingresos endpoints require TLS 1.3. Connections using older TLS versions are rejected.

Webhook signatures

Every webhook event includes an X-Signature header computed as HMAC SHA-256 over the raw body using your secret_key. See Webhooks for the verification procedure and a Node.js example.

Outbound IP allowlisting

If your webhook endpoint restricts inbound traffic by IP, fetch the current outbound IP list from GET /outbound_ips. See the Get Outbound IP Addresses API reference for the response shape and the Webhooks guide for recommended refresh cadence.

Status and availability

Real-time API status, incidents, and scheduled maintenance are published at status.burodeingresos.com.

Compliance

Buró de Ingresos is certified under ISO-27001. All personal data is processed in compliance with the Mexican Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP).