Base URL

https://api.merion.com.au

HTTPS only. All paths below are relative to this base URL.

Authentication

Some endpoints are public and require no token. Authenticated endpoints require a Bearer token obtained from auth.merion.com.au via OIDC/PKCE. See Authentication for the full walkthrough. API access is by arrangement — email [email protected] to request credentials.

Public endpoints

These endpoints require no authentication token.

GET /health: Service health check. Returns {"status":"ok"} with HTTP 200 when operational. Use for uptime monitoring — poll at most once per minute. See Health Endpoint for full detail.
GET /docs: Interactive Scalar UI rendering the OpenAPI spec. Open in a browser to explore request/response schemas and try endpoints. No token required to browse public endpoints.
GET /openapi.yaml: Raw OpenAPI 3.x specification in YAML format. Import into Postman, Insomnia, Bruno, or use to generate a typed client SDK. See OpenAPI Spec for import instructions.
GET /.well-known/openid-configuration: OIDC discovery document. Contains authorization_endpoint, token_endpoint, jwks_uri, and other auth configuration. Always read endpoint URLs from this document — do not hardcode them. See OIDC Discovery for the full field reference.
POST /public/forms/{key}: Unauthenticated form intake endpoint. Replace {key} with one of the available form keys. Body: {"form":"<key>","fields":{...},"hp":""}}. Available keys: contact, refer-a-debt, request-a-quote, partner-referral, become-a-partner. See Forms API for full payload schemas.

Authenticated endpoints

Authenticated endpoints are documented in the OpenAPI spec at /openapi.yaml and the interactive docs at /docs. They require a Bearer token from auth.merion.com.au. Access is by arrangement — email [email protected].

Common headers

Request headers

Content-Type: application/json: Required for all POST requests with a JSON body.
Authorization: Bearer <token>: Required for authenticated endpoints. Obtain via OIDC/PKCE — see Authentication.
X-Request-ID: <opaque-id>: Optional correlation identifier for support and diagnostic tracing. Merion echoes an accepted value in the response and logs it without request bodies, credentials or personal data.

Response headers

Content-Type: application/json: All API responses are JSON.
Retry-After: Present on 429 responses — the number of seconds to wait before retrying.
Cache-Control: Varies by endpoint. The health endpoint response is not intended for caching.
X-Request-ID: The request correlation identifier accepted or generated by Merion.
X-Response-Time-Ms: Origin processing time in milliseconds, supplied for diagnostics.

Quick curl examples

Health check

curl https://api.merion.com.au/health

Download OpenAPI spec

curl -O https://api.merion.com.au/openapi.yaml

OIDC discovery

curl https://auth.merion.com.au/.well-known/openid-configuration

Form submission — contact form

curl -s -X POST https://api.merion.com.au/public/forms/contact \
  -H "Content-Type: application/json" \
  -d '{"form":"contact","fields":{"name":"Test User","email":"[email protected]","message":"Test message}","hp":""}'

Authenticated request (example pattern)

curl -s \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-Request-ID: example-request-20260729" \
  https://api.merion.com.au/me

API Reference