Partner API tokens

A partner API token is for integration partners, such as a case management system, that work with ReviewSolicitors on behalf of many firms. One token works for every firm we have enabled for you: you tell us which firm each request is for with the X-Firm-Id header.

If you are a firm connecting your own systems, you do not need a partner API token. Generate a firm token from your Admin Dashboard instead.

	Firm token	Partner API token
Who it is for	A single firm	An integration partner serving many firms
Who creates it	The firm, in API Settings	ReviewSolicitors, on request
How you receive it	Shown in API Settings	A secure, one-time link sent by email
Which firm it acts for	Always the firm that created it	The firm named in `X-Firm-Id` on each request, if it is enabled for your token
What it can do	Everything in this API	Only the actions we enabled for your token

Getting a partner API token

Partner API tokens are issued by the ReviewSolicitors team. Ask your ReviewSolicitors contact and tell us which actions your integration needs, for example send review requests and read reviews. We enable only those actions, and we can change them later without issuing a new token.

When your token is ready, we email a secure link to the person who manages your integration. The link shows the token once and expires after 24 hours, so open it when you are ready to store the token somewhere safe. If the link has expired or was already used, ask us to send a new one: your token stays the same.

A partner API token can act for every firm enabled on it, so treat it like a master key. Keep it on your servers, never in client-side code or a public repository, and tell us straight away if it may have leaked so we can revoke it.

Firms

A partner API token only works for the firms we have enabled for it. A firm is enabled when:

the firm asks for your system in the Get more reviews section of its Admin Dashboard and we confirm it, or
you tell us which firms use your integration and we add them.

Requests for any other firm return 403, including an identifier that matches no firm. To add or remove a firm, ask your ReviewSolicitors contact: your token stays the same.

Making a request

Send the token as a Bearer token, and name the firm in the X-Firm-Id header.

cURL


curl --location 'https://www.reviewsolicitors.co.uk/api/v2/reviews' \
     --header 'Authorization: Bearer {partner_api_token}' \
     --header 'X-Firm-Id: SRA123456'

Everything else, such as paths, bodies and responses, is exactly as documented for each endpoint. Where a page says “your firm”, read it as “the firm named in the header”.

Identifying the firm

X-Firm-Id takes the same firm identifier as the firmID field of the v1 API, so an existing integration can reuse the values it already stores.

Format	Example	Identifies
`SRA` + SRA number	`SRA123456`	The firm that owns the active office with that SRA number.
`RS` + office ID	`RS67799`	The firm that owns the ReviewSolicitors office with that ID.

The prefix is not case sensitive. The firm must be active on ReviewSolicitors.

Permissions

Each partner API token is limited to the actions we enabled for it. Calling anything else returns 403.

Area	View	Manage
Reviews	List, retrieve, summary	Reply
Review requests	Retrieve	Create, block, unblock, cancel
Client Assist	List, retrieve	Accept, reject, report
Webhooks	List	Register, update, delete

Review requests created with a partner API token are recorded against your case management system, so firms can see where each request came from.

Errors

Status	Message	Cause
400	The X-Firm-Id header is required for partner API tokens.	The header is missing or empty.
400	The X-Firm-Id header must be an SRA number (e.g. SRA123456) or an RS office id (e.g. RS1234).	The value does not start with `SRA` or `RS`, or what follows the prefix is not valid.
403	This partner API token is not allowed to act for this firm.	The firm is not one of those enabled for your token, or no firm matches the identifier. Check the value, then ask us to add the firm.
404	No active premium firm found for the X-Firm-Id header.	The firm is enabled for your token, but it is no longer active or not on a premium membership.
403	This token does not have the REVIEWS_LIST scope.	The action is not enabled for your token. The message names the missing permission. Ask us to enable it.
403	This endpoint is not available to partner API tokens.	The endpoint is not one of those listed under Permissions.
401	Access denied. Authorization required to access this resource.	The token is missing, unknown, revoked or past its expiry date.

404 Not Found


{
  "code": "404",
  "status": "NOT_FOUND",
  "message": "No active premium firm found for the X-Firm-Id header.",
  "timestamp": "2026-01-31T09:30:00Z"
}

Moving from the v1 API

The v1 API took an apiKey and a firmID in the request body. With a partner API token:

the apiKey becomes the Authorization: Bearer header,
the firmID becomes the X-Firm-Id header, with the same value,
and the body only carries the fields documented for the v2 endpoint.