REST API

The REST API exposes the same tables and records you work with in the UI. Because authorization lives in the security model, an API client is bound by the same ACLs and row-level rules as a user — there’s no privileged back door.

Authentication

Authenticate with an API token issued to a service account. The account’s roles determine exactly what the token can read and write.

Authorization: Bearer <token>

Reading records

Query any table with filters, fields and pagination:

GET /api/v1/records/incident?state=open&limit=50

The response contains only the records and fields the caller is entitled to see.

Writing records

Create and update by posting a JSON body of field values:

POST /api/v1/records/incident
{
  "short_description": "Laptop won't boot",
  "priority": "2",
  "assignment_group": "service-desk"
}

Field-level ACLs still apply: a field the caller can’t write is rejected.

Errors

The API returns standard HTTP status codes — 401 for bad auth, 403 when the security model denies an action, 404 for records outside the caller’s visibility, and 422 for validation failures.