Getting Started with the New TM API URLs

Transaction Monitoring (TM) APIs now route through the unified Fenergo SaaS API gateway and share the same OAuth 2.0 authentication flow as CLM and other Fenergo SaaS APIs. This guide walks you through everything you need to start calling TM APIs on the new URLs.

For the full background on this change, see the release note: TM API URLs and Authentication Unified with Fenergo SaaS Platform.

Already integrated with CLM or another Fenergo SaaS API?

You can reuse your existing credentials — no separate setup is required for TM. Skip ahead to Step 2. Full details are in Fenergo SaaS API Authentication.

What's changing

TM API server URLs have moved from sentinels.cloud service endpoints to the standard Fenergo SaaS API gateway. This aligns TM with the rest of the Fenergo platform, so TM traffic now flows through the same infrastructure as CLM and other SaaS APIs — including the same network policies, rate limiting, and observability tooling.

	Old	New
Base URL	`*.sentinels.cloud`	`https://api.{region}.fenergox.com/tm/<service>`
Authentication	TM-specific	Shared OAuth 2.0 Client Credentials flow (same as CLM)

Before you begin

You'll need the following values from your Fenergo Customer Success contact:

Value	Description
`CLIENT_ID`	Your application's unique identifier
`CLIENT_SECRET`	Your application's secret key — treat this like a password
`TOKEN_URL`	The token endpoint for your tenant
`TENANT_SCOPE`	Your tenant scope, in the format `tenant/<tenant-id>`
`REGION`	Your tenant's region identifier (e.g. `emea1b`) — omit this for the default EMEA tenant

If you already have these values for CLM or another Fenergo SaaS API, they work for TM too. See Fenergo SaaS API Authentication for where these values come from and how the OAuth 2.0 Client Credentials flow works in detail.

Step 1 — Request an access token

Exchange your credentials once for a short-lived access token, then reuse that token for all subsequent API calls.

curl -X POST 'https://YOUR_TOKEN_URL' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=client_credentials' \
  -d 'client_id=YOUR_CLIENT_ID' \
  -d 'client_secret=YOUR_CLIENT_SECRET' \
  -d 'scope=YOUR_TENANT_SCOPE'

A successful response looks like this:

{
    "access_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IkVYQU1QTEVSRVBMQUNFRCJ9...",
    "expires_in": 3600,
    "token_type": "Bearer"
}

Token expiry

Your token expires after 1 hour (expires_in: 3600). After that, any API call will return 401 Unauthorized. Request a new token using the same command above — don't request a new token on every API call, as token requests are rate limited per IP address. See API Rate Limits for the current limit and TM API Rate Limits for the per-endpoint limits that apply once you're calling TM APIs.

Step 2 — Build your API URL

TM API URLs follow this pattern:

https://api.{region}.fenergox.com/tm/<service>

Replace {region} with your tenant's region identifier (e.g. emea1b).
For the default EMEA tenant, the region segment can be omitted: https://api.fenergox.com/tm/<service>.

The <service> segment identifies which TM API you're calling:

Service segment	APIs it serves	Documentation
`realtime`	Transaction API	API - Transaction
`realtime`	Transaction Batch API	Transaction batch API
`realtime`	Rule Execution API	Rule Execution API
`realtime`	Rule Rerun API	Rules Rerun API
`realtime`	Rule Schedule API	Rule Scheduling API
`aml`	Data Export API	Data Export API
`observability`	Observability API	Observability API

For example, to call the Transaction API in the emea1b region:

https://api.emea1b.fenergox.com/tm/realtime

The exact path for each operation (e.g. /v1/transactions) is documented on the corresponding API specification page linked above.

Step 3 — Call a Transaction Monitoring API

Include your access token in the Authorization header of every request:

curl -X POST 'https://api.emea1b.fenergox.com/tm/realtime/YOUR_OPERATION_PATH' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{ "...": "..." }'

Replace YOUR_ACCESS_TOKEN with the full access_token value from Step 1.

Refer to the API specification page for the TM API you're integrating with (linked in the table in Step 2) for the exact request/response schema for each operation.

Advanced: mTLS

If your integration requires mutual TLS, use the dedicated mTLS endpoints instead of the standard ones:

Purpose	Endpoint
Token Endpoint (mTLS)	`https://api-mtls.fenergox.com/sts/connect/mtls/token`
API Base URL (mTLS)	`https://api-mtls.fenergox.com`

The client certificate must be issued by Fenergo — this is a dependency of the AWS API Gateway, so you can't bring your own independently issued certificate.

See the Client Credential Flow with mTLS section of the Fenergo SaaS API Authentication guide for the full flow diagram and endpoint comparison.

Troubleshooting

Error	Most likely cause
`401 Unauthorized`	Token has expired — request a new one using Step 1
`400 Bad Request` on token request	Incorrect `client_id`, `client_secret`, or `scope` format
`403 Forbidden`	Token is valid but the client credentials lack permission for this resource
`404 Not Found`	Check the `<service>` segment and region in your URL against the table in Step 2

TM API URLs and Authentication Unified with Fenergo SaaS Platform — the release note announcing this change
Fenergo SaaS API Authentication — full authentication reference, including mTLS and regional token URLs
TM API Rate Limits — per-endpoint limits once you're calling the APIs
API Rate Limits — platform-wide rate limiting policy

If you have any questions, reach out to your Fenergo Customer Success contact.

What's changing​

Before you begin​

Step 1 — Request an access token​

Step 2 — Build your API URL​

Step 3 — Call a Transaction Monitoring API​

Advanced: mTLS​

Troubleshooting​

Related docs​