REST API
Everything the web app does, it does through /api/v1. The full reference is
generated from the server’s OpenAPI spec, under API reference in this sidebar,
and served live by every install at /api/v1/openapi.json.
Authentication
Section titled “Authentication”curl https://assets.example.com/api/v1/me -H "Authorization: Bearer ab_..."Make a key in the app (Connections) or with POST /api/v1/keys. A key works in one
project with one scope: read, propose, write or admin. An unknown or
revoked key is a 401, never a fallback to anonymous. People in the app carry
a session cookie instead.
Errors
Section titled “Errors”Every error has the same shape:
{ "error": { "code": "limit_reached", "message": "That would pass this organization's storage of 10 GB (9.8 GB used)", "detail": { "limit": "storage", "max": 10000000000 } } }| Status | Codes |
|---|---|
| 400 | invalid_request, invalid_transform |
| 401 | unauthorized, password |
| 403 | forbidden, setup_required, limit_reached, read_only |
| 404 | not_found |
| 409 | conflict |
| 410 | gone |
| 413 | too_large |
| 422 | invalid |
| 429 | rate_limited, with Retry-After |
Stability
Section titled “Stability”/api/v1 is frozen since 1.0: what worked against it keeps working until a
/v2, which would run beside it. New routes, new optional inputs and new
fields in responses arrive in minor versions, so ignore fields you don’t know.
See Stability for exactly what is promised and how
something is retired.