Tenderen API (v1)

All endpoints are versioned under /api/v1. Requests and responses are JSON over HTTPS.

https://api.tenderen.com/api/v1

Send your API key as a Bearer token in the Authorization header. Keys are created in the app under Developers → API keys by a company Owner or Admin on the Enterprise plan. The full key is shown once; Tenderen stores only a SHA-256 hash of it. Keys can have an expiry date and can be revoked at any time.

curl "https://api.tenderen.com/api/v1/tenders?q=software&cpvCodes=72000000&limit=20" \
  -H "Authorization: Bearer $TENDEREN_API_KEY"

Scopes

Each key carries a list of scopes. New keys default to read-only (tenders:read). Calling an endpoint whose scope the key lacks returns 403 INSUFFICIENT_SCOPE.

Paths are relative to the base URL. The scope column shows the permission the key needs.

List endpoints accept page (starting at 1) and limit (1–100, default 20) and return a pagination object with page, limit, total and pages. GET /tenders also accepts q, cpvCodes and regions (comma-separated), status, source, minValue, maxValue, deadlineBefore, deadlineAfter, sort (publishedAt, deadline or estimatedValue) and order (asc or desc).

{
  "success": true,
  "data": [ { "id": "…", "title": "…", "deadline": "…" } ],
  "pagination": { "page": 1, "limit": 20, "total": 412, "pages": 21 }
}

Errors return success: false with a human-readable error and a machine-readable code.

{
  "success": false,
  "error": "Insufficient permissions. Required scope: bids:write",
  "code": "INSUFFICIENT_SCOPE"
}

Each API key may make 1,000 requests per hour by default (the limit is stored per key). Going over returns 429 RATE_LIMIT_EXCEEDED; wait for the hourly window to reset. The MCP endpoint has its own limit of 1,000 requests per hour per token.

Status: you can register, list and delete webhook endpoints today, but event delivery is not live yet — no events are sent to registered endpoints at the moment. The format below is what deliveries will use. Poll the REST API (for example GET /alerts/notifications/list) until delivery ships.

Register an HTTPS endpoint with POST /webhooks and choose the events you want. The response contains a signing secret, shown only once.

Events

• tender.new — A new tender matches one of your alerts.
• tender.deadline — A followed tender's deadline is approaching.
• tender.awarded — A followed tender has been awarded.
• bid.submitted — A bid was marked as submitted.
• bid.status_changed — A bid changed status.
• alert.triggered — An alert produced new matches.

Verifying signatures

Every delivery is a POST with the JSON body {event, data, timestamp, webhookId} and the headers X-Tenderen-Event, X-Tenderen-Delivery and X-Tenderen-Signature. The signature is sha256= followed by the hex HMAC-SHA256 of the raw request body, keyed with your signing secret. Compare it in constant time before you trust the payload.

import crypto from 'node:crypto';

function isValidTenderenSignature(rawBody, signatureHeader, secret) {
  const expected =
    'sha256=' + crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
  const a = Buffer.from(signatureHeader ?? '');
  const b = Buffer.from(expected);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

A delivery that fails, or does not answer with a 2xx status within 10 seconds, is retried up to two more times: after 1 minute and after 5 minutes. The delivery history is available from GET /webhooks/:id/deliveries.

Tenderen runs a remote Model Context Protocol server, so AI assistants such as Claude, ChatGPT and Cursor can search tenders, assess fit, track a pipeline, draft bids and ask the tender documents on your behalf — 18 capability tools, with read access granted by default and writes, submissions and deletions as separate grants on the consent screen. Connect with OAuth (authorization code with PKCE; dynamic client registration is supported) or with an API key as a Bearer token. Tools that cannot be undone preview first and need confirmation. Every call is listed under Developers → AI connections, where connections can be tested and revoked.

MCP endpoint (Streamable HTTP)

https://tenderen.com/api/mcp

Legacy endpoint (HTTP+SSE)

https://tenderen.com/api/mcp/sse

OAuth discovery

https://tenderen.com/.well-known/oauth-authorization-server
https://tenderen.com/.well-known/oauth-protected-resource

Questions about the API or a specific integration: [email protected].

Last reviewed 4 October 2026