Feature
Public API
The SignalDeck Public API exposes scoped, audited access to workspaces, posts, scheduling, approvals, analytics, reports, webhooks, and API keys. Every route declares its authentication, permissions, scopes, tenant scope, idempotency behavior, and rate-limit bucket — so you can integrate without guessing what the server expects.
API surface
Predictable, scoped, and auditable.
Base path /api/v1
All routes live under /api/v1 with stable versioning. Breaking changes ship under new major versions; existing versions are supported per the deprecation policy.
Scoped API keys
Keys are scoped per organization, hashed at rest, and never re-displayable after creation. Each key lists its allowed scopes (read, write, ai, billing, webhook, admin) and can be revoked instantly.
Idempotent writes
Write routes accept an Idempotency-Key header. Duplicate requests with the same key return the original response — safe to retry through transient failures.
RBAC at the route layer
Routes enforce role-based access before any handler runs. A scoped key can never escalate beyond what its scopes allow; an org admin can never accidentally touch another org's data.
Rate limits per org and key
Seven buckets counted per API key, per organization, or per IP in fixed 60-second windows, with x-ratelimit-* headers on every response. Ceilings are listed on the rate-limits page.
Audit events on sensitive actions
Every sensitive action — auth, billing, deletion, role change, key rotation — produces an audit event with actor, scope, timestamp, and payload. Audit exports are queryable.
Route groups
What you can integrate today.
/workspaces
List, create, and inspect workspaces under your organization.
/posts
Create, schedule, update, and inspect posts with capability validation.
/approvals
Submit, advance, and audit approval state per post and per workspace.
/analytics/overview
Pull rollups with source and freshness metadata; respects RBAC.
/reports
Generate, schedule, and export reports with stale-data disclosures preserved.
/api-keys
Rotate, scope, and revoke keys; never re-display secrets after issuance.
/webhooks
Subscribe to events, inspect deliveries, replay failed deliveries within retention.
Versioning + maturity
Build against a stable contract.
The /api/v1 contract is locked. Endpoints that are still in private preview return a clearly labeled 501 with the production schema, so you can integrate today and the wire format won't change when they go live.
FAQ
Frequently asked
How do I authenticate?
Bearer token with a scoped API key. Include `Authorization: Bearer <key>` on every request. Keys are issued via /api-keys and require a one-time secret reveal.
What's your deprecation policy?
Breaking changes ship under new major versions. Older versions are supported for at least 12 months after a successor ships, with deprecation headers on every response.
Do you have client SDKs?
Official Node and Python SDKs ship shortly. The REST contract is fully usable today with any HTTP client.
Start building
Provision an API key and integrate today.
Scoped keys, signed webhooks, and audit logs on every action.