Predictable, scoped, and auditable.#
- Base path /api/v1. All routes live under /api/v1 with stable versioning. Breaking changes ship under new major versions; existing versions are supported per the deprecation policy.
- Scoped API keys. Keys are scoped per organization, hashed at rest, and never re-displayable after creation. Each key lists its allowed scopes (read, write, ai, billing, webhook, admin) and can be revoked instantly.
- Idempotent writes. Write routes accept an Idempotency-Key header. Duplicate requests with the same key return the original response — safe to retry through transient failures.
- RBAC at the route layer. Routes enforce role-based access before any handler runs. A scoped key can never escalate beyond what its scopes allow; an org admin can never accidentally touch another org's data.
- Rate limits per org and key. Seven buckets counted per API key, per organization, or per IP in fixed 60-second windows, with x-ratelimit-* headers on every response. Ceilings are listed on the rate-limits page.
- Audit events on sensitive actions. Every sensitive action — auth, billing, deletion, role change, key rotation — produces an audit event with actor, scope, timestamp, and payload. Audit exports are queryable.
What you can integrate today.#
- /workspaces. List, create, and inspect workspaces under your organization.
- /posts. Create, schedule, update, and inspect posts with capability validation.
- /approvals. Submit, advance, and audit approval state per post and per workspace.
- /analytics/overview. Pull rollups with source and freshness metadata; respects RBAC.
- /reports. Generate, schedule, and export reports with stale-data disclosures preserved.
- /api-keys. Rotate, scope, and revoke keys; never re-display secrets after issuance.
- /webhooks. Subscribe to events, inspect deliveries, replay failed deliveries within retention.
Build against a stable contract.#
The /api/v1 contract is locked. Endpoints that are still in private preview return a clearly labeled 501 with the production schema, so you can integrate today and the wire format won't change when they go live.
Route reference#
/workspaces/posts/approvals/analytics/overview/reports/api-keys/webhooks
Questions#
- How do I authenticate?
- Bearer token with a scoped API key. Include
Authorization: Bearer <key>on every request. Keys are issued via /api-keys and require a one-time secret reveal. - What's your deprecation policy?
- Breaking changes ship under new major versions. Older versions are supported for at least 12 months after a successor ships, with deprecation headers on every response.
- Do you have client SDKs?
- Official Node and Python SDKs ship shortly. The REST contract is fully usable today with any HTTP client.