Trickest API

REST API for the Trickest workflow automation platform: build and version workflows, execute and monitor runs, read run and subjob outputs, query Live Tables, manage workspaces and projects, and browse the Trickest Library.

Authentication#

Send an Authorization header on every authenticated request. Two token forms are accepted:

• Authorization: Token <api-token> — a personal API token created in the dashboard under Settings > Developer > API Token. This is the form to use for scripts, CI, and agents. The same token authenticates the trickest CLI, the @trickest/sdk npm client, and the hosted MCP server at https://api.trickest.io/mcp.
• Authorization: Bearer <jwt> — a session JWT, as issued by POST /auth/login and refreshed by POST /auth/token-refresh.

Tokens containing a . are JWTs and take the Bearer scheme; everything else is an API token and takes the Token scheme. There is no OAuth authorization server, no OpenID Connect discovery, and no dynamic client registration: the API token is minted in the dashboard and sent verbatim. Rotate it with POST /users/me/token/regenerate.

Authorization#

Access is role-based, not OAuth-scoped — there are no per-token scopes to request or consent to. A token carries exactly the permissions of the user who created it. Every user holds one vault-level role (VaultRoleEnum) and, per workspace, one workspace role (SpaceRoleEnum). Roles may be assigned to teams; effective permissions are the union of team and direct roles, most permissive wins. Read the caller's own assignments with GET /rbac/vault/roles and GET /rbac/spaces/{spaceId}/roles.

The role model is mirrored machine-readably in the top-level x-trickest-roles extension. Operations that map to exactly one row of the published permission matrix also carry x-trickest-min-vault-role or x-trickest-min-workspace-role. Operations without such an annotation still enforce a role server-side; it is simply not documented per-operation yet, so treat the absence as unknown rather than unrestricted. Role-based access control is an Enterprise-plan feature; see https://trickest.com/docs/key-concepts/roles-and-permissions.

Errors#

Failures return { "code": string, "message": string } with the matching HTTP status. The shared 400, 401, 403, 404, 429, and 500 responses in components.responses carry that schema.