API

REST, JSON, workspace-scoped. Base URL: https://www.navrik.co.uk/api/v1.

Authentication

Bearer an sk_live_ key:

Authorization: Bearer sk_live_…

Each key is scoped to one workspace and a set of scopes. The key is hashed at rest; only the hash + prefix are stored.

Scopes (least privilege)

leads:*, events:*, crm:*, social:*, workspaces:*, documents:*, webhooks:*, keys:*, oauth:*, memory:*, metrics:read, audit:read, proposals:*. A key with * has all scopes.

Errors

Standard HTTP codes: 400 bad JSON, 401 missing/invalid key, 403 missing scope, 404 not found, 409 conflict/invalid transition, 422 validation, 5xx server. Bodies are { "error": "code" }.

Public & token endpoints

Some surfaces need no key — storefront browse, availability, guest booking/lookup, promo validation, and quote/review pages via signed tokens. These take workspaceId explicitly.

Webhooks

Register endpoints to receive events (e.g. lead.created). Deliveries are signed and retried.

The proxy pattern (for front-ends)

A workspace's website should call authed endpoints through a server-side proxy that holds the sk_live_ key — never expose it to the browser. Public/token endpoints can be called directly.

Reference

The full, always-current endpoint reference is the interactive /developers page (OpenAPI at /api/v1/openapi.json). Coverage is CI-enforced (ADR-0005) — every route is documented.