Getting Started

Overview

The REST API is the primary programmatic surface: JSON under https://app.triplebooks.com/api/..., documented in openapi.json and in the sidebar modules below.

• Authentication: Authorization: Bearer ak_... using an API key from API keys in Settings. Keys are pinned to one entity and to module scopes (read:ledger, write:crm, and so on). The first path segment after /api/ selects the module (for example, /api/ledger/... needs ledger scopes). Write scope implies read for the same module.
• Interactive use: Signed-in browser traffic hits the same routes; you do not send a Bearer header from the UI.

Base URL: https://app.triplebooks.com

Authentication

curl "https://app.triplebooks.com/api/ledger/accounts?entityId=<uuid>" \
  -H "Authorization: Bearer ak_..."

Create and revoke keys under Settings → API keys. Rate limits apply per key.

Multi-tenant routing

Each organization has an isolated database. Requests are scoped to one entity. Pass entityId in this order (first match wins):

1. entityId or entity_id query parameter
2. x-entity-id header — useful for GET requests that do not put entityId in the query string
3. On POST/PUT/PATCH, entityId in the JSON body if not already set above
4. Authorization: Bearer ak_... — the API key is already pinned to an entity; include entityId in query, body, or header only when it must match that key’s entity

CRM, Sales, Helpdesk, and most module APIs use this model so the same routes work for signed-in browser sessions and Bearer API keys.

Endpoints

The sidebar is one folder per product module (closed until you open it). Folders are grouped under Core and Experimental, matching the platform overview. Each folder opens to Overview plus resource pages. Short links without the section segment (for example /api/entities) redirect to the canonical URL (/api/workspace/entities). Single-page modules (Health, Helpdesk, and similar) sit at the top level.

Rate limits

API requests are rate-limited per API key. Typical limits:

• 100 requests/minute for read endpoints (GET)
• 30 requests/minute for write endpoints (POST/PUT/PATCH/DELETE)

Rate limit headers may be included in responses:

X-RateLimit-Limit: 100
X-RateLimit-Remaining: 97
X-RateLimit-Reset: 1709164800

Errors

All errors return a JSON body with an error field:

{ "error": "Entity not found" }