https://partner-api.rhythm.tryrima.com from your backend with Authorization: Bearer <key>.
Keys are scoped to approved operations and companies. Keep the key in a secrets manager and out of email and support requests.
Responses include x-request-id. Include that ID and the request timestamp when reporting a failed request. Never include the key.