The Noots API — what it is and isn't
Read this first: what you can build, and what deliberately isn't there yet.
Noots has a small, honest HTTP API. It exists for the things people actually asked for — reading your work from somewhere else, pushing a transcript or a meeting in, letting another tool set off one of your rules, and getting told when something happens here. It is not a general-purpose remote control for the product, and this page would rather tell you that up front than have you find out three days in.
The four surfaces
| Surface | Direction | Authenticated by |
|---|---|---|
| The v1 API | You call us | A personal token in an Authorization header. |
| Outgoing webhooks | We call you | An HMAC signature on the request we send. |
| The automation hook | You call us | A secret in the URL. |
| Monitoring intake | Your alerting tool calls us | A secret in the URL. |
What isn't built
All four of these are true today, and none of them is an oversight we're hiding:
- There is no OAuth app model. You cannot build an app that other Noots workspaces install and authorise. A token belongs to one person in one organization and is created by that person.
- There are no per-scope permissions. A token records
readandwritein its row, and nothing anywhere consults that record. Treat any token as full access to everything its owner can reach through the routes below. - Outgoing webhooks have no retry queue. One attempt, four seconds, and the response is not examined. If your endpoint was down, that delivery is gone — build your integration so a missed call is recoverable.
- There is no versioning policy beyond the `v1` in the path. We haven't yet promised a deprecation window, so don't infer one.
A token is not a service account. It acts as the human who made it, in the organization they made it in — so it sees the projects they can see, and it stops working the moment they stop being an active member. There is no way to get a credential with more reach than a person.
If what you want is "do this whenever that happens", check Automations first. A rule needs no code, logs every firing, and can call your webhook as one of its actions.