{"success":true,"message":"ReadmeResponse","data":{"content":"# API\n\nA JSON API authenticated with bearer tokens. API paths are relative to `\/api`,\nrequest and response bodies are `application\/json`, and\n[\/openapi.json](\/openapi.json) is the generated contract.\n\n## The envelope\n\nEvery response the API produces is the same object:\n\n```json\n{\n  \"success\": true,\n  \"message\": \"ResourceResponse\",\n  \"data\": {},\n  \"type\": \"ResourceResponse\"\n}\n```\n\n## Errors\n\nErrors use the same envelope with `success: false` and `type: \"error\"`:\n\n```json\n{\n  \"success\": false,\n  \"message\": \"unauthorized\",\n  \"errors\": [\"unauthorized\"],\n  \"type\": \"error\"\n}\n```\n\n## Authentication\n\nThere is no login endpoint and no session: a bearer token is the only credential the\nAPI accepts. Send it on every authenticated request:\n\n```\nAuthorization: Bearer <token>\n```\n\nGet your first token from the web UI, under Settings \u2192 Credentials, where you can name\nit and give it an optional expiry. The plain-text token is shown once and stored only as\na hash, so it cannot be read back \u2014 issue a new one instead.\n\nTokens are named, granted and revoked from that same page: there is no endpoint that\nissues or revokes one. Tokens default to all abilities and no expiry.\n\n## Abilities\n\nAn ability is one method reaching one path, written `GET:\/api\/resource` \u2014 the path exactly as\nthe document keys it, so a templated segment stays templated: `DELETE:\/api\/resources\/{resource}`.\nA token granted `*` reaches everything, which is what a token is issued with unless you\nsay otherwise.\n\nA request the token was not granted is refused with a `403` and\n`\"message\": \"missing_ability\"` before it reaches the endpoint, so nothing is read, written\nor validated. Abilities are set on a token when it is issued, and changed afterwards from\nthe web UI under Settings \u2192 Credentials, where each token has a grid of every endpoint\nagainst every method it answers.\n\nConsult the OpenAPI document for the current endpoints and the abilities they require.\n"},"type":"ReadmeResponse"}