The rule that matters most
A request never states which tenant it belongs to. Scope is derived from the verified token on the server. That is the difference between an API that is multi-tenant and one that merely has a tenant column.
Resource
Everything the console does, the API does
The console is a client of the same REST API you get. Responses share one envelope, errors share one taxonomy, and the tenant is taken from a verified token — never from the request body.
What you get
REST + JSON
Versioned under /api/v1 with a machine-readable OpenAPI description.
One envelope
Every response carries success, code, message, data and a request id.
Typed errors
Validation 400, authentication 401, permission 403, not found 404, upstream 502.
Token auth
RS256 JWTs with refresh families and server-side revocation.
Tenant safety
Organisation and branch come from the verified token, so a body field cannot widen scope.
Events
Kafka topics for audit, sync, notification and domain events.
Rate limits and idempotency
Requests are rate limited per identity and per endpoint class. Write endpoints accept an idempotency key, so a retried request cannot produce a second charge.
Questions people actually ask
- Is there a sandbox?
- Yes — a separate environment with its own keys and data, requested with your account.
- Do you have webhooks?
- Yes, plus Kafka topics for deployments that consume events directly.