The introduction below is the same one on the API reference page; this page adds the generated, per-endpoint detail.
The WorkBOS public API is a REST API scoped to a single workspace by the API key you send with every request. There is no separate account id or organization id to pass: the key already knows which workspace it belongs to, so a read or a write can never reach any other workspace.
curl "https://dkjdtyzjdkumnpdyezbs.supabase.co/functions/v1/api-v1/tasks?limit=20" \
-H "Authorization: Bearer snrp_YOUR_KEY"| Topic | How it works |
|---|---|
| Authentication | Every request carries Authorization: Bearer snrp_... Create a key under Developer > API keys. |
| Scopes | A key is Read only or Read and write. A read-only key gets 403 on any POST, PATCH or DELETE. You can change a key’s scope later without reissuing it. |
| Pagination | List endpoints take ?limit= (up to 200, default 50) and ?offset=, and return the page inside { data, limit, offset, count }, so count tells you the total without a second request. |
| Errors | A failed request returns a normal HTTP status and a JSON body of { error, message }: a short code such as rate_limited or read_only_key, plus a plain sentence. |
| Idempotency | The API has no idempotency key today. If a write times out, check whether it went through before you retry it: sending the same POST again creates a second record, not the same one. |
| Rate limits | Two ceilings apply per minute, one per key and one per calling IP address. See Rate limits and errors for the numbers and how to handle a 429. |
Six resources are exposed today: tasks, projects, deals, contacts, companies and invoices. Invoices are read only through the API. Every other resource supports list, get, create, update and delete for a key with the write scope.
Every operation, its parameters and generated curl, Node and Python samples, grouped by resource.
Have WorkBOS call your own URL the instant something changes, instead of polling for it.
Point an AI assistant at the same workspace data, under the same permissions.
The exact request ceilings, the error shape, and what a 429 means for your retry logic.