Partner API · v1

SponsorNote Partner API

A read-only REST API for partner platforms (PlayNSports, analytics tools, league dashboards) and individual Premier + Title sponsors to fetch campaign metrics, NIL deal data, and event counts.

Access policy: Sponsor-scoped API access is reserved for sponsors holding an ACTIVE Premier or Title sponsorship. Entitlement is enforced at both key issuance and every request. Lower-tier sponsors can still see their data in the in-app dashboard.

Base URL

https://sponsornote.com

Discovery

GET /api requires a valid Bearer key. Unauthenticated callers receive 401 Unauthorized with a pointer back here. Authenticated callers receive a list of live endpoints, scopes, and the rate limit.

curl -i https://sponsornote.com/api
# → HTTP/1.1 401 Unauthorized

curl -i -H "Authorization: Bearer snk_live_…" https://sponsornote.com/api
# → HTTP/1.1 200 OK  + discovery JSON

Authentication

Every authenticated request must include an Authorization header with a Bearer token. Keys begin with snk_live_ and are scoped at issuance to one of: platform-wide, one organization, or one sponsor (Premier/Title). Contact partners@sponsornote.com to provision a key.

Authorization: Bearer snk_live_…

Scopes

  • metrics:read — aggregated metrics for an organization
  • campaigns:read — campaign details (status, goals, dates)
  • events:read — raw event stream access
  • sponsorships:read — sponsor's own sponsorships, offers, events, and NIL deals

Rate limits

120 requests/minute per key. Responses include X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset headers. Exceeding the limit returns HTTP 429.

Endpoints

GET /api/v1/orgs/{orgId}/metrics

Required scope: metrics:read

Aggregate metrics for an organization: total raised, total goal, event counts (QR scans, clicks, reveals, redemptions), per-campaign breakdown.

curl -H "Authorization: Bearer snk_live_…" \
  https://sponsornote.com/api/v1/orgs/ORG_ID/metrics

GET /api/v1/sponsors/{sponsorId}/metrics

Required scope: sponsorships:read · Entitlement: ACTIVE Premier or Title sponsorship

Full sponsorship + offer breakdown for one sponsor — every QR scan, click, reveal, and redemption, plus attached NIL deals, captured leads, and the program's social-post log. Sponsor-scoped keys can only read their own data.

curl -H "Authorization: Bearer snk_live_…" \
  https://sponsornote.com/api/v1/sponsors/SPONSOR_ID/metrics

GET /api/v1/sponsors/{sponsorId}/metrics/stream

Required scope: sponsorships:read · Entitlement: ACTIVE Premier or Title sponsorship

Server-Sent Events stream for real-time dashboards — emits an initial snapshot event, then delta events when totals change. Connection closes ~55s; standard EventSource clients reconnect automatically. Not counted against the 120 req/min REST quota.

const es = new EventSource(
  "https://sponsornote.com/api/v1/sponsors/SPONSOR_ID/metrics/stream",
  // Set the Authorization header via fetch + EventSource polyfill, or
  // proxy through your backend.
);
es.addEventListener("snapshot", (e) => console.log(JSON.parse(e.data)));
es.addEventListener("delta", (e) => console.log("update:", JSON.parse(e.data)));

GET · PATCH /api/sponsor/targeting

Auth: session cookie or Premier/Title Bearer key.

Read or update which states and cities your sponsorship outreach should prioritize. Useful for syncing targeting from a CRM.

curl -X PATCH https://sponsornote.com/api/sponsor/targeting \
  -H "Authorization: Bearer snk_live_…" \
  -H "Content-Type: application/json" \
  -d '{ "targetStates": ["NC","SC"], "targetCities": ["Charlotte","Boone"] }'

Example sponsor response

{
  "sponsor": {
    "id": "spn_…",
    "name": "Sal's Pizza",
    "category": "Restaurant / Food & Beverage",
    "status": "APPROVED"
  },
  "totals": {
    "sponsorships": 2,
    "totalSpendCents": 900000,
    "events": { "qrScans": 412, "clicks": 510, "reveals": 367, "redemptions": 148 },
    "nilDeals": { "total": 1, "active": 1 }
  },
  "sponsorships": [
    {
      "id": "spx_…",
      "packageTier": "PREMIER",
      "amountCents": 750000,
      "status": "ACTIVE",
      "campaign": { "id": "cmp_…", "slug": "appstate-baseball-spring-2025", "name": "Spring 2025", "status": "ACTIVE", "org": {…} },
      "totals": { "qrScans": 332, "clicks": 410, "reveals": 287, "redemptions": 118 },
      "offers": [
        { "id": "ofr_…", "slug": "sal-pizza-20pct", "title": "20% off camp Saturdays", "code": "SAL-20", "events": { … } }
      ],
      "nilDeals": [
        {
          "id": "nil_…",
          "athleteName": "Jordan Hayes",
          "athleteSchool": "UNC Charlotte",
          "athleteSport": "Baseball",
          "amountCents": 250000,
          "status": "APPROVED",
          "startDate": "2026-09-01T00:00:00.000Z",
          "endDate": "2027-06-01T00:00:00.000Z",
          "schoolDisclosedAt": "2026-08-25T00:00:00.000Z"
        }
      ]
    }
  ],
  "compliance": {
    "nilGuidelines": "All NIL deals must comply with NCAA name-image-likeness policy and applicable state law.",
    "disclosureRequirement": "Each NIL deal must be disclosed to the athlete's school compliance office before activation."
  },
  "generatedAt": "2026-05-23T00:00:00.000Z"
}

NIL contracts

Sponsors can attach name-image-likeness deals to their sponsorships in the dashboard at /sponsor/nil-deals. Each deal stores athlete, school, deliverables, dates, deal value, and an optional contract URL. Deals go through compliance review before activation.

All NIL deals must follow the NCAA name-image-likeness policy and applicable state law. Deals must be disclosed to the athlete's school compliance office before activation.

Errors

  • 401 — missing, malformed, expired, or revoked key
  • 403 — valid key but missing scope, wrong org/sponsor, or entitlement lapsed (no ACTIVE Premier/Title sponsorship)
  • 404 — entity not found
  • 429 — rate limit exceeded

Security

  • Keys are hashed (SHA-256) at rest — we never store the plaintext.
  • Keys are shown once at creation and cannot be retrieved later.
  • Lost a key? Revoke it from the admin console and issue a new one.
  • All traffic is HTTPS-only.
  • Lookups use constant-time comparison to prevent timing attacks.
  • Sponsor-scoped keys re-check Premier/Title entitlement on every request.
Questions? Email partners@sponsornote.com.