Branding API

Resolves the effective branding (logo, colors, brand name, support email) that should apply for the calling org or, when called by an unauthenticated subaccount surface, for a custom-domain host. Base path: /api/v1/branding Authentication: API key (X-API-Key) or session JWT. An unauthenticated caller may pass X-Tenant-Host: <custom-domain> to resolve the branding of the tenant that owns that domain — this is how a white-labelled sign-in page renders before a session exists (at a lower, IP-keyed rate limit).

Method	Path	Purpose
`GET`	`/api/v1/branding/effective`	Get the effective branding for the calling tenant

This endpoint is hot — the Next.js dashboard middleware polls it on every authenticated render. Responses carry Cache-Control: private, max-age=60, so each client caches for ~60 s.

Get effective branding

GET /api/v1/branding/effective The resolver merges the calling org’s branding with its reseller parent chain: any field the org has not set for itself is inherited from the parent, and unset-on-every-side fields come back null (the platform default theme applies). If a database blip makes branding unresolvable, the endpoint still returns 200 with a fully-nulled neutral shape so the dashboard shell never fails to render.

API key

The dashboard’s own path: authenticate with your org’s API key (or a session JWT) and the response is scoped to that org, inheriting any fields the org leaves unset from its reseller parent chain.

curl "https://api.orbit.devotel.io/api/v1/branding/effective" \
  -H "X-API-Key: $ORBIT_API_KEY"

White-label host (unauthenticated)

Before a session exists — e.g. a white-labelled sign-in page on a custom domain — pass the bare host in X-Tenant-Host with no credentials. The response is scoped to the tenant that registered that domain. This path is rate-limited by IP rather than by org, at a lower ceiling than authenticated calls, so pass the host only (no path separator, no scheme):

curl "https://api.orbit.devotel.io/api/v1/branding/effective" \
  -H "X-Tenant-Host: support.acme.example"

API key

200

{
  "data": {
    "organization_id": "org_a41f3c2b9d",
    "logo_url": "https://cdn.orbit.devotel.io/branding/org_a41f3c2b9d/logo.png",
    "logomark_url": "https://cdn.orbit.devotel.io/branding/org_a41f3c2b9d/mark.png",
    "primary_color": "#4F46E5",
    "accent_color": "#06B6D4",
    "brand_name": "Acme Support Desk",
    "support_email": "help@acme.example",
    "help_logo_url": null,
    "help_primary_color": null,
    "help_header_links": null,
    "help_show_powered_by": null,
    "inherited_from_organization_id": "org_parent7k9m",
    "inherits_from_parent": true
  },
  "meta": {
    "request_id": "req_brand_001",
    "timestamp": "2026-08-25T10:00:00Z"
  }
}

White-label host

When the resolved tenant hasn’t flipped on parent inheritance (inherit_branding_from_parent off), the response carries the tenant’s own values with a null parent pointer:

200

{
  "data": {
    "organization_id": "org_b27d8e4f1c",
    "logo_url": "https://cdn.orbit.devotel.io/branding/org_b27d8e4f1c/logo.png",
    "logomark_url": null,
    "primary_color": "#0EA5E9",
    "accent_color": null,
    "brand_name": "Acme Support",
    "support_email": "help@acme.example",
    "help_logo_url": null,
    "help_primary_color": null,
    "help_header_links": null,
    "help_show_powered_by": null,
    "inherited_from_organization_id": null,
    "inherits_from_parent": false
  },
  "meta": {
    "request_id": "req_brand_002",
    "timestamp": "2026-08-25T10:00:01Z"
  }
}

inherited_from_organization_id names the parent org a value came from; inherits_from_parent is true when the calling org takes the parent’s branding wholesale (subaccounts with inherit_branding_from_parent enabled). Both fields are resolver diagnostics — keys to know where the value came from, not a branching condition for your own rendering.

From the SDKs

Node.js
Web (browser)

The Node SDK reads the calling org’s branding with its own credentials — useful for server-side rendering of white-labelled portals:

import { Orbit } from '@devotel-orbit/node';

const orbit = new Orbit({ apiKey: process.env.ORBIT_API_KEY });
const { data } = await orbit.branding.get();

// data.logo_url, data.primary_color, data.brand_name, ...

Browser surfaces — a sign-in page on a white-labelled custom domain, an embedded help widget — read branding without an API key using the host-lookup path:

const res = await fetch('https://api.orbit.devotel.io/api/v1/branding/effective', {
  headers: { 'X-Tenant-Host': 'support.acme.example' },
});
const { data } = await res.json();
// data.primary_color, data.brand_name, ...

Client caching

The responses carry Cache-Control: private, max-age=60. Cache the resolved branding per host (or per org) for up to that 60-second window instead of re-fetching on every render; fall back to your default theme when branding can’t be resolved, the same fallback the endpoint itself uses:

const BRANDING_TTL_MS = 60_000; // match max-age=60
let cached: { at: number; data: unknown } | null = null;

async function getBranding(host: string) {
  if (cached && Date.now() - cached.at < BRANDING_TTL_MS) return cached.data;
  const res = await fetch('https://api.orbit.devotel.io/api/v1/branding/effective', {
    headers: { 'X-Tenant-Host': host },
  });
  if (!res.ok) return null; // render your default theme
  const { data } = await res.json();
  cached = { at: Date.now(), data };
  return data;
}

API Reference

All Endpoints

Effective branding: logo, colors, and brand per tenant

Branding API

Get effective branding

From the SDKs

Client caching

See also

​Branding API

​Get effective branding

​From the SDKs

​Client caching

​See also

Branding API

Get effective branding

From the SDKs

Client caching

See also