Authentication

Every request must send an API key as a bearer token:

Authorization: Bearer rp_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Getting a key

An org admin creates keys in the console: Settings → Developer → API keys → New key. The full key (rp_live_…) is shown once at creation — copy it then; only a hash is stored, so it can’t be retrieved later. Revoke a key from the same screen; revocation is immediate.

Scopes

Each key has a scope, chosen at creation:

Scope	Can do
read	All GET endpoints.
write	Everything a read key can, plus every mutating endpoint (create / reply / assign / tag / close / reopen).

A key acts with org-wide access — every inbox in the workspace.

Expiry

A key can be given an optional expiry. A key past its expiry is rejected exactly like an unknown one (401). Leave it unset for a key that never expires. Rotate by creating a new key, switching your integration over, then revoking the old one.

Errors

Status	Meaning
401 Unauthorized	Missing, malformed, expired, or unknown API key.
403 Forbidden	A read key used on a write endpoint.
400 Bad Request	Invalid body/params (Zod validation) — the message names the problem.
404 Not Found	The resource doesn’t exist (or isn’t in your workspace).
409 Conflict	An Idempotency-Key was reused with a different body, or a same-key request is still in flight.
429 Too Many Requests	Rate limit exceeded — honor Retry-After.