Products & Subscriptions

The Product Management area is how a tenant turns Lexabit products on and off, supplies any credentials a product needs, and manages subscriptions. A product is identified by a URL-friendly slug (for example, account-tracking or company-intelligence), and everything hangs off that slug.

All endpoints live under /productmanagement/v1 and are scoped.

1. Browse the catalog

curl "https://api.lexabit.com/productmanagement/v1/products" \
  -H "Authorization: Bearer $LEXABIT_TOKEN" -H "X-Scope: 42"

GET /products/{slug} returns one product in detail. Before trying to activate, you can check whether the current scope is even eligible:

curl "https://api.lexabit.com/productmanagement/v1/products/account-tracking/eligibility" \
  -H "Authorization: Bearer $LEXABIT_TOKEN" -H "X-Scope: 42"

2. Activate a product

Activation is a two-step flow: begin it (which creates a pending activation), then complete it. The split lets you collect anything the product needs — credentials, an integration choice — in between.

curl

# Step 1 — begin activation
curl -X POST "https://api.lexabit.com/productmanagement/v1/products/account-tracking/activate" \
  -H "Authorization: Bearer $LEXABIT_TOKEN" -H "X-Scope: 42"

# Step 2 — complete activation
curl -X POST "https://api.lexabit.com/productmanagement/v1/products/account-tracking/activate/complete" \
  -H "Authorization: Bearer $LEXABIT_TOKEN" -H "X-Scope: 42"

Python

import os, requests

BASE = "https://api.lexabit.com/productmanagement/v1"
H = {"Authorization": f"Bearer {os.environ['LEXABIT_TOKEN']}", "X-Scope": "42"}
slug = "account-tracking"

pending = requests.post(f"{BASE}/products/{slug}/activate", headers=H).json()["data"]
# ...supply credentials / pick an integration here if the product needs them...
active = requests.post(f"{BASE}/products/{slug}/activate/complete", headers=H).json()["data"]

JavaScript

const BASE = "https://api.lexabit.com/productmanagement/v1";
const H = { Authorization: `Bearer ${process.env.LEXABIT_TOKEN}`, "X-Scope": "42" };
const slug = "account-tracking";

let r = await fetch(`${BASE}/products/${slug}/activate`, { method: "POST", headers: H });
const pending = (await r.json()).data;
// ...supply credentials / pick an integration here if the product needs them...
r = await fetch(`${BASE}/products/${slug}/activate/complete`, { method: "POST", headers: H });
const active = (await r.json()).data;

Step 1 returns a pending activation:

{
  "data": {
    "id": "act-71c2-…",
    "productId": "prod-accounttracking",
    "entityType": "tenant",
    "entityId": "2f5a9c1e-…",
    "status": "pending",
    "createdAt": "2026-07-06T11:00:00Z"
  },
  "meta": { "requestId": "c3d1…" }
}

Check state anytime with GET /products/{slug}/status, list all activations with GET /activations, and cancel a pending one with DELETE /products/{slug}/activate/cancel. To turn a product off entirely, DELETE /products/{slug}/activate.

3. Supply credentials (when a product needs them)

Some products need provider credentials (an API key, client secret, etc.). Manage them per product:

# Set / update credentials
curl -X PUT "https://api.lexabit.com/productmanagement/v1/products/account-tracking/credentials" \
  -H "Authorization: Bearer $LEXABIT_TOKEN" \
  -H "X-Scope: 42" \
  -H "Content-Type: application/json" \
  -d '{ "apiKey": "…", "clientId": "…" }'

GET returns their status (never the secret values back), and DELETE removes them. Credentials are write-only by design — you can tell whether they're set, not read them back.

4. Integrations behind a product

A product can be backed by one or more provider integrations (for example, different banks or data providers). List the eligible ones, attach an integration, and set which is used:

curl "https://api.lexabit.com/productmanagement/v1/products/account-tracking/integrations/eligible" \
  -H "Authorization: Bearer $LEXABIT_TOKEN" -H "X-Scope: 42"

Use POST /products/{slug}/integrations to attach one and PUT /products/{slug}/activate/integrations to choose the active set.

5. Subscriptions

Subscriptions track the tenant's current plan:

# The active subscription
curl "https://api.lexabit.com/productmanagement/v1/subscriptions/current" \
  -H "Authorization: Bearer $LEXABIT_TOKEN" -H "X-Scope: 42"

GET /subscriptions lists history, POST /subscriptions creates one, and DELETE /subscriptions/current (or /{id}) cancels.

Where to go next

• Account Tracking — a product that uses this activation
  • credentials flow in anger
• API Reference → Product Management