REST API authentication
Authenticate server-side calls to the AgentStack REST API.
The REST API base path is /api/v1. Send an API key from a server you control using Authorization: Bearer <API key>; do not ship that key in a widget, mobile bundle, or public repository. The generated OpenAPI contract is available at /api/v1/openapi.json, with an interactive reference at /reference.
API access requires a paid organization subscription. A missing key returns 401 with UNAUTHORIZED; an invalid or expired key returns 401 with INVALID_API_KEY; a free or unsubscribed organization receives 403 with PLAN_UPGRADE_REQUIRED. Keys use a scope hierarchy of read, write, then admin: a higher scope satisfies a lower one. Most mutations need write, while destructive operations can require admin. Custom-role mutations additionally require an owner-created key and Enterprise.
The normal JSON envelope is { success, data, error }: success responses set error to null, and failures set data to null. The public exceptions are the OpenAPI document and GET /webhooks/event-types; authenticate all other integrations deliberately.