Management API

Authentication

Scoped management credentials: explicit scopes, application or organization binding, product confinement, rotation with grace.

Create a credential on the workspace's API page and send it as a bearer token. A credential is bound either to one application and environment or to the whole organization; it holds explicit scopes, may be confined to some products, and rotates with a grace period so the old secret keeps working while you roll the new one out. Routes about people and credentials themselves are never available to a credential; those need a signed-in member.

GET https://obsidian.rip/api/v1/applications/{app}/licenses?environment=production&limit=50
Authorization: Bearer <management credential>
Accept: application/json

Conventions

• Every route lives under /api/v1, takes and returns JSON, and echoes an X-Request-ID you can quote when asking about a call.
• Application routes take ?environment= (development, staging, or the default production).
• Lists answer {items: […]}. Lists that grow (licenses, devices, sessions, events, customers, resellers, campaigns) also answer next_cursor; pass it back as ?cursor= with ?limit= up to 500.
• Anything that mints (licenses, bundle codes, credits) takes an Idempotency-Key header. A retry with the same key answers the same thing and never reveals a secret twice.
• Writes that must not race carry If-Match with the revision you read; a stale write is refused with 409 STALE_WRITE.
• Requests are metered per credential and per address; a ceiling reached answers 429 RATE_LIMITED and clears within a minute.

Errors

A refusal is a JSON body with a stable code, a sentence for a person, and the request id.

{ "error": { "code": "FORBIDDEN", "message": "This credential's scopes do not include licenses.write.", "request_id": "…" } }

Reference

Every route the API answers, read from its own OpenAPI document when this page renders. Public routes need no credential. Request and response bodies, with a try-it that calls each route as you, are on the workspace's API page once you sign in.