API reference

API reference

Generated from the OpenAPI document the CorrConnect service itself serves, so it describes the code that runs. Download it as openapi.json.

Conventions

• Base URL. Every path is relative to your CORRCONNECT_BASE address. Token, revoke, profile and activity routes are also served on the API host if your invitation names one.
• Versions. Data routes live under /v1. Changes inside v1 add fields and values; see versioning.
• Formats. JSON in and out, except /oauth/token and /oauth/revoke-token, which take application/x-www-form-urlencoded bodies as OAuth requires.
• Auth. Data routes take a Bearer access token. App and webhook management takes the console session cookie, plus Origin and X-CSRF-Token on changes. See accounts and apps.
• Errors. {"code", "message", "request_id", "details"?}, except the token endpoint's OAuth shape. See errors.
• Caching. Responses under /v1 and /oauth are sent with Cache-Control: no-store.
• Browsers. There are no CORS headers, so browser JavaScript on another site can't call the API. Call it from your server or a native app.
• Request IDs. Every response has X-Request-ID.

Samples

Every operation has a sample in cURL, JavaScript (Node.js 20 or later, run as an ES module), Python (with requests) and Swift (5.9 or later). They read these environment variables:

All operations