# The API manual

<!-- module: s12-api · deck: A program uses the workspace's API with a token you make: only what you may do yourself, in the workspace it was made in, for 90 days, every call counted and every token in the logs. -->

**Table of contents · 24 October 2026 · S12 of plan CORE. Two endpoints are published as the pattern (who is
calling, the workspace's people); each module publishes its own when it needs to.**

A program (a payroll system, a script) uses the API with a **token**: a secret you make on Your API tokens. It works in
the workspace it was made in, only for what you allowed it, and only while you may still do that yourself. It stops
after 90 days, when you revoke it, or the moment your membership is turned off. The API's document lists every
endpoint, with what it takes and what it answers.

The one sentence to carry through it: **a token can never do more than its maker may do, in its maker's workspace.**

**Who meets what**

| Seat | Who | What they do here |
|---|---|---|
| Owner, Admin | Whoever may make API tokens (`token.manage`) | Makes and revokes their own tokens, reads the document |
| A program | Holding a token | Calls `/api/v1/…` with `Authorization: Bearer` and the token |
| Service | The platform's owner | Sets how many calls a minute and how long a token works; reads the document |

**As shipped**

| | Shipped |
|---|---|
| A new token works for | 90 days (1–365) |
| Calls a minute, per token | 120 (10–6,000) |
| Published endpoints | `GET /api/v1/me`, `GET /api/v1/person` |
| The document | `/docs/api` |

---

## Part 1 · The API

- [1.1 Making an API token](p01-api.md#11-making-an-api-token)
- [1.2 Calling the API](p01-api.md#12-calling-the-api)
- [1.3 Revoking a token](p01-api.md#13-revoking-a-token)
- [1.4 Reading the API's document](p01-api.md#14-reading-the-apis-document)
- [1.5 Setting the API's limits (Service)](p01-api.md#15-setting-the-apis-limits-service)