How do I authenticate?

Authorization: Bearer osk_YOUR_KEY on requests to /api/v1. See /docs/api for the full catalog.

Can an API key access Setup?

No. Keys only perform API operations allowed by their permission profile.

Where do I create keys?

Workspace admins issue keys in Setup → API keys after defining permission profiles.

How is this different from Integrations?

Integrations cover Google and Telegram. The API is for your own services, ETL, and partner systems.

Secure programmatic access to your CRM

Issue workspace API keys bound to permission profiles. Bearer authentication on /api/v1 for objects, fields, and records—the same governance members get in Operations.

REST surface

Objects, fields, records

osk_

Bearer keys

Shown once, revoke anytime

RLS

Enforced access

Permission profiles on every call

Headless CRM, same governance

Scoped Bearer keys on /api/v1 — objects, fields, records.

External systems should not need a browser session to stay in sync with your pipeline. OSTRATA exposes a versioned REST API so jobs, ETL pipelines, and partner apps read and write records with explicit scope.

Each key inherits exactly one permission profile. Revoke anytime; secrets are shown once at creation. Keys never grant Setup access—only what the profile allows on /api/v1.

Scoped Bearer keys
osk_ secrets with Authorization: Bearer on every request.
Full record lifecycle
List, create, read, update, and delete records per object type.
Profile-bound access
Same object and field rules as teammates—not a superuser back door.

Keys

Keys tied to permission profiles

Create a profile first, then issue a key that inherits it.

Name keys for the integration (billing sync, warehouse ETL)
Copy the secret once—it is not shown again
Revoke compromised or retired keys immediately

Endpoints

/api/v1 surface

Versioned REST endpoints over your workspace schema.

Objects and field definitions for discovery
Records CRUD with search and pagination
Documented catalog at /docs/api with curl examples

Bidirectional

Enforcement on every call

Row-level security and profile checks apply to API clients.

No cross-workspace data leakage
Field-level restrictions match member experience
Consistent behavior for chat and HTTP

Automation

Bidirectional sync patterns

Push outbound events and accept inbound updates from your stack.

Poll or webhook your middleware on deal close
PATCH records when billing or ERP status changes
Keep OSTRATA and external systems as co-equal sources

Questions

Short answers before you request access.

How do I authenticate?: Authorization: Bearer osk_YOUR_KEY on requests to /api/v1. See /docs/api for the full catalog.
Can an API key access Setup?: No. Keys only perform API operations allowed by their permission profile.
Where do I create keys?: Workspace admins issue keys in Setup → API keys after defining permission profiles.
How is this different from Integrations?: Integrations cover Google and Telegram. The API is for your own services, ETL, and partner systems.