API reference
Every REST endpoint the platform exposes, generated directly from the API's own specification and rebuilt on every release.
Browse it from the API reference section in the sidebar, grouped by resource.
The reference currently tells you which endpoints exist — method, path, grouping, and the permission each one needs. It does not yet document request bodies, response bodies, or field-level schemas, because the specification it is generated from does not carry them.
So it is a reliable map of the API surface, and not yet a substitute for reading a real response. To learn a payload shape today, call the endpoint.
You will also see internal identifiers as labels — EntityTypesController_list
rather than "List entity types" — for the same reason. Both are fixed by the
same work: publishing schemas from the API's validation layer into the
specification.
The reference reflects the published specification, which is generated from the API but not guaranteed to be regenerated on every change. If an endpoint here does not behave as described — or an endpoint you know exists is missing — trust the running API and report the discrepancy.
Conventions
| Base path | Every endpoint is versioned under a common prefix |
| Tenant | Taken from your token, never from the URL |
| Authentication | A bearer token issued by the platform, obtained by signing in through your identity provider. An identity-provider token is not accepted directly. |
| Pagination | Page and page-size parameters; responses carry the totals |
| Sorting | A sort parameter; prefix a field with - to reverse it |
| Filtering | Per-field filter parameters |
Permissions
Almost every endpoint requires one or more permission codes. Lacking one returns 403 with the missing code named in the response, so a failure tells you exactly what to grant.
A small number are deliberately public: the health probe, the sign-in and callback routes, and the key-set endpoint.
Errors
Errors share one envelope: a machine-readable code, a human-readable message resolved for the caller's language, per-field detail for validation failures, and a trace identifier.
Quote the trace identifier when reporting a problem — it locates the request directly. See error codes.
Language
Send a standard language header and error messages come back in that language where a translation exists. Codes never change — they are stable identifiers, not display text.
Not translated
This reference is published in English only. It documents endpoint paths, field names, option values, and error codes, all of which are product surfaces that must match exactly what the API accepts. Translating them would create a reference that disagreed with the software.
Last verified against commit e6fa3bb7 (2026-08-03)