REST API Settings (Public) (44.123.2-0)

Authentication

Almost every endpoint requires both of the following headers:

• x-api-key — your API key, identifying the calling application.
• x-access-token — a session access token identifying the acting user, obtained from the session/login endpoints.

Requests missing either header are rejected with 401.

A handful of endpoints — logging in, brand redirects and other bootstrap operations — are reachable without an access token. Those are documented individually as requiring no security scheme.

API versioning

A small number of routes expose more than one version. Select one with the accept-version header; when omitted it defaults to 0.0.1. Versioned operations document accept-version as a required parameter.

Errors

Errors share a common shape — a machine-readable code and a human-readable message — and are returned as JSON with the corresponding HTTP status.