API reference
Overview & authentication
Base URL, auth, tenancy, and errors.
The REST API is served under /api/v1. All requests require a bearer token and a tenant.
Authentication
- Authorization: Bearer <token> — a per-tenant API key or a user access token (verified, RS256/HS256).
- X-Tenant-ID: <tenant> — scopes the request; the token’s tenant claim must match.
Errors
Errors use standard HTTP status codes with a JSON body: 401 (auth), 403 (scope/tenant mismatch), 404, 422 (validation), 429 (rate limit).
The complete, always-current reference is generated from the gateway’s OpenAPI spec. The endpoints below are the core surface.