Trickest API
REST API for the Trickest workflow automation platform: build and version workflows, execute and monitor runs, read run and subjob outputs, query Live Tables, manage workspaces and projects, and browse the Trickest Library. ## Authentication Send an `Authorization` header on every authenticated request. Two token forms are accepted: - `Authorization: Token <api-token>` — a personal API token created in the dashboard under **Settings > Developer > API Token**. This is the form to use for scripts, CI, and agents. The same token authenticates the `trickest` CLI, the `@trickest/sdk` npm client, and the hosted MCP server at `https://api.trickest.io/mcp`. - `Authorization: Bearer <jwt>` — a session JWT, as issued by `POST /auth/login` and refreshed by `POST /auth/token-refresh`. Tokens containing a `.` are JWTs and take the `Bearer` scheme; everything else is an API token and takes the `Token` scheme. There is no OAuth authorization server, no OpenID Connect discovery, and no dynamic client registration: the API token is minted in the dashboard and sent verbatim. Rotate it with `POST /users/me/token/regenerate`. ## Authorization Access is role-based, not OAuth-scoped — there are no per-token scopes to request or consent to. A token carries exactly the permissions of the user who created it. Every user holds one vault-level role (`#/components/schemas/VaultRoleEnum`) and, per workspace, one workspace role (`#/components/schemas/SpaceRoleEnum`). Roles may be assigned to teams; effective permissions are the union of team and direct roles, most permissive wins. Read the caller's own assignments with `GET /rbac/vault/roles` and `GET /rbac/spaces/{spaceId}/roles`. The role model is mirrored machine-readably in the top-level `x-trickest-roles` extension. Operations that map to exactly one row of the published permission matrix also carry `x-trickest-min-vault-role` or `x-trickest-min-workspace-role`. Operations without such an annotation still enforce a role server-side; it is simply not documented per-operation yet, so treat the absence as unknown rather than unrestricted. Role-based access control is an Enterprise-plan feature; see https://trickest.com/docs/key-concepts/roles-and-permissions. ## Errors Failures return `{ "code": string, "message": string }` with the matching HTTP status. The shared `400`, `401`, `403`, `404`, `429`, and `500` responses in `components.responses` carry that schema.
Base URL
https://trickest.io/api