The API is the same one the product uses. Every endpoint is listed in the API reference, which is generated from the service's own routing table.
curl https://api.example.com/v1/orgs/acme/assets \
-H "Authorization: Bearer $ACT_KEY"Pagination
Lists return a next_cursor. Pass it back as cursor to get the next page; when it is absent, you have everything. There are no page numbers, so rows cannot shift between pages while someone else is editing.
Errors
Every error has the same shape. Branch on code, which is stable; message is written for people and may change.
{
"error": {
"code": "validation_failed",
"message": "…",
"request_id": "…",
"fields": { "expires_on": "…" }
}
}- 401 unauthenticated — missing, expired or revoked key.
- 403 forbidden — the key's role is too low for this action.
- 404 not_found — does not exist, or is not in this organisation. The two are deliberately indistinguishable.
- 409 conflict — for example, a tag that is already in use.
- 402 plan_limit_reached — fields names the resource, the limit and how much is used. 402 trial_expired means the trial has ended.
- 422 validation_failed — fields names each bad input.
- 429 rate_limited — wait for the Retry-After header.
Rate limits
Each key or signed-in user gets 10 requests a second, with bursts of up to 30. Quote the request_id when you contact support; it finds your request in our logs.
Dates
Expiry and due dates are plain calendar dates (2026-03-31). Timestamps such as created_at are ISO 8601 in UTC.