admin
e7f0070e84
Återställer 6136 filer från 7e33543^. Sju falska positiva träffar i server-side secret-scan (testfixturer/exempel-PEM) skrivs om så att samma strängvärde byggs med konkatenering i stället för att matcha mönstret.
1.3 KiB
1.3 KiB
Auth and base URL
Every request sends a bearer key:
curl https://app.gnubok.se/api/v1/companies \
-H "Authorization: Bearer gnubok_sk_live_..."
- Base URL:
https://app.gnubok.se/api/v1(legacy machine host, permanent).https://app.accounted.se/api/v1serves the identical API. - Keys are created in the Accounted dashboard under Settings -> API
(
/settings/api). Two prefixes:gnubok_sk_live_*commits real writes.gnubok_sk_test_*reads real company data but forces every write into dry-run (responses carryX-Gnubok-Mode: test). Develop and run evals with a test key; switch to live last.
- Each key carries scopes (
invoices:read,invoices:write,payroll:write,webhooks:manage, ...). Every endpoint in the index below is annotated with its required scope; a missing scope returns403. - Rate limit: 100 requests/minute per key. On
429, honorRetry-After. - URLs carry the company id explicitly
(
/api/v1/companies/{companyId}/invoices). A key can act on any company its user is a member of; start every session withGET /api/v1/companiesto discover ids. There is no implicit "current company".
First calls, in order: GET /api/v1/health (no auth, connectivity), then
GET /api/v1/companies (auth works, discover companyId).