Information
- License:
- OpenAPI version:
3.1.0
Overview
Adversarial API 0.1.0
Section titled “Adversarial API 0.1.0”Every endpoint under an organization resolves that organization from the X-Org-Slug request header, whose value is the organization’s slug (the same one that appears in the web app’s URLs, e.g. acme-corp). A cookie-authenticated request to such an endpoint that sends no header is refused with 403 This request must name an organization; naming one the caller cannot reach is 401.
Bearer tokens ignore the header: a token is issued for one organization and always acts in that one.
A handful of endpoints are scoped to the user rather than an organization — GET /v1/context, POST /v1/organizations, the invite endpoints under /v1/users/me, and the two image endpoints a browser cannot attach headers to. Those accept the header and honour it, but fall back to the organization the caller resumes in when it is absent.
Authentication
Section titled “Authentication”bearer
Section titled “bearer”Security scheme type: http
oauth2
Section titled “oauth2”session
Section titled “session”Security scheme type: apiKey
Cookie parameter name: arm-session