REST API authentication

The REST API base path is /api/v1. Send the API key from a server that you control. Use the header Authorization: Bearer <API key>. Do not put the key in a widget, a mobile bundle, or a public repository. The generated OpenAPI contract is available at /api/v1/openapi.json. An interactive reference is available at /reference.

API access requires a paid organization subscription. The API returns 401 with UNAUTHORIZED for a missing key. The API returns 401 with INVALID_API_KEY for an invalid or expired key. The API returns 403 with PLAN_UPGRADE_REQUIRED for a free or unsubscribed organization. Keys use a scope hierarchy: read, write, and admin. A higher scope includes the permissions of a lower scope. Most mutations need write scope. Destructive operations can require admin scope. Custom-role mutations also require an owner-created key and Enterprise.

The JSON envelope is { success, data, error }. A success response sets error to null. A failure response sets data to null. The OpenAPI document and GET /webhooks/event-types do not require authentication. Authenticate every other request.