API docs

Authentication

Authenticate every request with a Bearer key:

Authorization: Bearer vca_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Keys are created in the dashboard (Integrations → API Keys) and shown once. Requests without a valid key get 401:

{"error":{"code":"invalid_api_key","message":"Missing or malformed API key"}}

Scopes. A key has either full access (default) or read-only. GET endpoints require read access; all POST/PATCH/DELETE require write access. A read-only key calling a write endpoint gets 403:

{"error":{"code":"missing_scope","message":"This key is missing the 'write' scope"}}

Plan gating. API access requires a plan with the API feature enabled; otherwise every request returns 403 api_not_enabled. Webhook-subscription endpoints additionally require the webhooks feature (403 webhooks_not_enabled).

Key hygiene. Treat keys like passwords: server-side only (the API sends no CORS headers — browser calls are unsupported by design), one key per system, revoke from the dashboard immediately if exposed (revocation is instant), rotate periodically.