api · developers · 2026-07-12
What an API-first DSP actually means
Most ad platforms bolt an API onto a UI. Building the other way around changes what's possible: for integrations, white-label products, and teams that want agents later.
"We have an API" usually means a partial, lagging shadow of the UI: the endpoints the platform needed internally, documented after the fact, versioned never.
API-first means the opposite dependency. The console is a client of the same API everyone else gets. If a human can do it in the UI, a key with the right scope can do it over HTTPS.
The Waveband contract
Every request and response is defined as a typed schema first. The OpenAPI 3.1 document is generated from those schemas, not written by hand, so the docs cannot drift from the behavior.
API keys carry scopes. Rate limits are published per plan tier. Webhooks push entity changes so integrations do not poll. POST endpoints accept an Idempotency-Key header, which matters more in advertising than most domains: a retried request that creates a duplicate campaign spends real money.
What developers actually wire
Partner apps authenticate with OAuth instead of borrowed operator logins. White-label builders replace the entire UI without losing a capability. Internal tools pull reporting into the same warehouse as CRM and finance.
The optional MCP server is a thin layer over the same services. Teams that want agents get tools. Teams that do not can ignore them forever.
- Typed schemas first; OpenAPI generated, not hand-maintained
- Scoped API keys and published rate limits by plan
- Webhooks for entity changes (no polling tax)
- Idempotency-Key on mutating POSTs that spend money
- Same service layer for console, REST, and optional MCP
Why it compounds for resellers
An API-complete platform is what makes white-label products real. If the docs hide half the console behind "contact sales," you are not building a product. You are renting a screenshot.
Waveband is the buying seat: campaigns, creatives, reporting, billing, and portals run on Waveband rails. Your integration is not a thin skin over someone else's identity.
Safety when software acts
Mutating advertising state needs harder guarantees than reading a report. Scopes, audit logs, and idempotency are not developer niceties. They are how you keep accidental double-creates out of the client's invoice.
If you later enable agents, those same controls apply. Nothing gets autonomous spend privileges by default.
Where to start
Create a scoped key, hit the OpenAPI reference, and build one read path before any write path. Wire webhooks early so your sync job does not become a cron that hammers list endpoints.
Resellers and platform builders should also read the white-label docs. The API is how you own the experience. The brand settings are how clients never see the underlying platform name.