REST API v1
Base URL /api/v1. Authenticate with Authorization: Bearer <api key> or an OAuth access token. Resources represent business capabilities, not tables.
/identities(with/identities/{id}/riskand/identities/{id}/trust-score),/people,/organizations/verify/verification-sessions(documents are added at/verification-sessions/{id}/documents)/credentials,/credential-schemas,/credential-verifications/background-checks/risk-assessments,/consents/cases,/evidence,/audit-events,/events/policies,/webhooks,/usage
All mutations accept Idempotency-Key. Rate limits are hierarchical (organization → project → key). The OpenAPI document is served at /api/v1/openapi.json and documents every route.
Idempotency
A key is bound to the request it first came with (method, path and body; JSON key order and whitespace do not matter). The same key with the same request replays the first result and runs nothing (header Idempotent-Replayed: true where a replay is distinguishable). The same key with a different request is refused with 422 idempotency_key_reused. A request that failed or was refused does not use up its key, so retrying it runs again. Every command is recorded with its outcome.
Capabilities
GET /capabilities lists everything Authpermit can be asked to do, once for every channel: the REST routes, the MCP tool and the automation action of each capability, its permission, risk, danger class (read < analyze < mutate < destructive < critical), schemas and whether it needs approval, plus granted for your key. Operations in the OpenAPI document carry x-authpermit-capability.
Action routes
POST /endpoints/{id}/quarantineand/release(security:respond;{id}is the endpoint id or device id)POST /incidents/declare(incident:manage)
Events
GET /events lists the newest events first. Add since (ISO 8601) or cursor to read them as a stream in the order they happened; pass next_cursor back as cursor to continue. It is returned on an empty page too, so a poller keeps its place. A key sees only its own environment.