Authentication

Every REST call runs as a real signed-in user. There is no separate service-account or app-key concept — you authenticate as yourself, and the API enforces the exact same workspace membership and module access rules it would in the browser.

Personal Integration Tokens

A PIT (Personal Integration Token) is a long-lived key tied to your account. Generate one from Developer → PIT Key in the app, or via the API itself:

bash

curl -X POST https://api.conexus-x.example/api/api-key/generate \
  -H 'Authorization: Bearer YOUR_SESSION_JWT'

Generating a new key immediately invalidates the old one, and is rate-limited to once every 20 minutes. A request inside that window is rejected with the timestamp you may next regenerate at.

Using the key

Send it as the x-api-key header on every request. The server accepts either that or a session Authorization: Bearer JWT on the exact same routes — a PIT is simply the credential that outlives a browser session.

bash

curl 'https://api.conexus-x.example/api/workspaces' \
  -H 'x-api-key: YOUR_PIT_KEY'

Base URL

All REST endpoints in this reference are relative to your Conexus X API host, mounted under /api:

text

https://api.conexus-x.example/api

Errors

Every failure answers with a JSON body carrying a message, and the status code names the kind of failure:

Status	Meaning
401	No key/token, or it isn't valid — check the header name and that the key wasn't just rotated.
403	Authenticated, but not a member of the workspace, or the module is private and access wasn't granted.
404	The id in the path doesn't exist, or isn't visible to you.
429	Rate-limited — currently only on POST /api-key/generate.
503	The database is unreachable. Retry shortly; this is never a client-side problem.

What you can reach

A PIT key has the full reach of your own account — every workspace you belong to, every module you can open. There are no scopes on a PIT the way there are on an Extensions SDK view; scoping belongs to a narrower guest running inside an iframe you don’t control, not to a script you wrote yourself and run with your own credentials.

Keep your PIT key out of client-side code — anything a browser can read, a visitor can read.
Rotate it if it ever leaks; the old one stops working the instant a new one is generated.
For a view that runs inside other people’s workspaces, use the Extensions SDK instead — it never has access to anyone’s PIT key at all.