OpenPostHTTP API
Authenticate and make your first OpenPost API request.
Use the HTTP API when you need raw HTTP, use a language other than JavaScript or TypeScript, or need an operation that the SDK does not cover.
Hosted uses this base URL:
https://app.openpo.st/api/v1For self-hosting, append /api/v1 to the public OpenPost origin.
Create a developer token in Settings > Personal > Developer. Use api:read for reads or api:write for changes. For unattended work, create one token per integration, give it only the scopes it needs, bind it to one workspace when possible, and set an expiry.
Send the token as a bearer token:
curl https://app.openpo.st/api/v1/workspaces \
-H "Authorization: Bearer $OPENPOST_TOKEN" \
-H "Accept: application/json"Use an ID from the response whenever an operation asks for workspace_id. OpenPost checks scope and workspace access on every private request. Passing a different workspace ID does not expand a workspace-bound token.
Store credentials
- Put tokens in your platform's secret store, not in source code or command history.
- Keep Hosted and self-hosted tokens separate.
- Revoke a token when the integration no longer runs.
- Use HTTPS for every remote instance.
401 means the bearer token is missing, invalid, expired, or revoked. 403 means the token is valid but lacks a required scope or workspace, or the requested account or plan cannot run the operation.
API reference
The API reference is generated from the current OpenAPI contract. It lists every path, body, response, parameter, and required header. These guides explain common workflows and do not replace that reference.
Download the contract from /openapi.json to generate a client. Do not copy request or response schemas into your integration because those copies drift when the API changes.