The Suprata API

REST over HTTPS, JSON in and out, authenticated by API key. Connect Suprata to systems you run — a booking site that creates customers, a script that pulls invoices, a dashboard on your own stack.

Base URL

https://<your-account>.suprata.com/api/v1

v1 is current. Fields get added to responses without notice; nothing is removed or repurposed within v1 (breaking changes would ship as v2). Parse leniently — ignore fields you don't recognize.

Authentication

Generate a key in Suprata under Suprata Automate → API Keys, then send it as a bearer token:

curl https://your-account.suprata.com/api/v1/me \
  -H "Authorization: Bearer sk_live_your_key"

X-Api-Key: <key> is accepted too, for clients that strip Authorization.

Each key has a scope (read or read,write) and a mode (live / test). Scope is fixed at creation — issue a new key to change it. GET /v1/me echoes the account and scopes the key resolved to; call it first to confirm wiring.

Keys bypass user permissions

This is the part that isn't obvious. A key is a service account, not a user — it reaches every record its resources cover and ignores the per-user permissions that gate the UI. A write key can change anything in scope, no matter who created it. Consequences:

• Store keys like passwords — env var or secrets manager, never client-side or committed to a repo.
• Only admins can mint them (gated by the "Manage API Keys" permission), so creating a key can't be used to escalate past permissions you've set.
• Revoke a leaked key immediately; revocation is instant.

Pagination

Cursor-based, not page-numbered (cursors don't skip or double-count when rows are added mid-walk):

• limit — page size, 1–200 (default 50).
• starting_after=<id> — records after that id.
• The response carries has_more and next_cursor. Loop, passing next_cursor back as starting_after, until has_more is false.

Response shape

List:

{ "object": "list", "resource": "invoices", "count": 50, "has_more": true, "next_cursor": 567371, "data": [ … ] }

A single-record fetch returns the bare object.

Errors

Next

• Endpoints & fields — every endpoint, its query params, and each resource's fields.
• Writing data (operations) — the write surface.
• GET /v1/openapi.json — OpenAPI 3.0 spec for SDK generation / Swagger UI.