API Reference
Resource-oriented REST, JSON, versioned by the Substratal-Version request header (currently 1). Read Conventions first — every other page here assumes it. The same contract is available as OpenAPI 3.1 in OpenAPI Specification, with an interactive Swagger UI reference.
| Group | Covers |
|---|---|
| Conventions | Base URL, auth header, pagination, idempotency, error shape, ID format. |
| Auth | Signup, login, MFA, sessions, password and email lifecycle, invitations, and app tokens (embedded, and hosted + PKCE). |
| Users | Account lifecycle. |
| Profiles | Global and per-app identity data. |
| Settings | Global and per-app configuration. |
| Applications | The app catalog. |
| Entitlements | Grant, toggle, revoke access to an app — the on/off switch. |
| Roles & Permissions | Assign/remove roles; resolve effective permissions. |
| Organizations | Team management and org-wide grants. |
| SCIM | An Organization’s identity provider inviting and removing its members (SCIM 2.0). |
| Tenancy | Where a Tenant’s data lives, and the (support-only) process to change it. |
| Billing | The Free/Standard subscription: a User’s or Organization’s plan, Stripe Checkout and Portal, and which members an Organization covers. |
| Audit | Query the audit log. |
| Webhooks | Subscribe to access-change events, including the required access.revoked. |
| Push Notifications | Alerts and updates to a User’s devices (APNs, FCM, Web Push) and their notification inbox: device registration, an Application’s push credentials, sending, and platform alerts. |
| API Keys | Service-to-service credentials — how billing or an app’s own backend authenticates. |
These pages specify the target contract for an API that does not yet exist. If you’re implementing against this, these are the shapes to build toward — check the repository’s actual code for what’s already real before assuming a page here is live.
Calling this from an AI agent rather than writing HTTP calls by hand? See MCP Server — a tool-call interface generated from openapi.yaml, not a separate contract from the one on this page.