Where are the API docs, and how do API keys work?
Last verified October 18, 2026
The API reference is at /docs/api. Keys are issued in Settings > API keys, are shown only once, and act as the member who created them. A key is read only unless you give it write access.
You need: Manage API keys (held by the team Owner unless a role grants it)
The docs
The full reference lives at /docs/api. It covers authentication, paging, writing, errors and rate limits, with an entry for every endpoint. There's also an OpenAPI document at /api/v1/openapi.json you can feed to a client generator.
The API covers your team's roster, tasks, schedule, checklists, notebook, announcements, finance, scouting and picklists.
Issue a key
- In Team Management, open Settings > API keys.
- Under Issue a key, type a name for whatever will hold the key, like "Pit display laptop".
- Choose Read only or Read and write.
- Click Create key.
- Copy the key from Your new key.
The key is shown once and stored as a hash, so nobody can read it back later. If you lose it, revoke it and make a new one. Keys start with rbl_.
How a key behaves
A key has no permissions of its own. It acts as the member who issued it, and their role is checked on every call. Take a permission away and the key loses it straight away. Remove the member from the team and the key stops working.
| Access | What it can do |
|---|---|
| Read only | Answers questions. Changes nothing. |
| Read and write | Creates, changes and deletes whatever its owner can, and only while the team isn't locked |
Every change a key makes is recorded under Recent AI and API changes on the AI access page, visible to members with "Manage settings".
Using a key
Send it as a bearer token:
curl -H "Authorization: Bearer rbl_..." https://robolyst.org/api/v1/me
Start at /me when something is refused. It reports the role, permissions and features the key has.
Keep keys on a server. The API sends no CORS headers, so a web page can't call it, and anyone can read a key placed in a page's source.
Limits
- 120 requests a minute per key. Going over returns a 429 with a Retry-After header.
- Lists return 50 rows by default and 200 at most, with a cursor for the next page.
Manage and revoke
Active keys lists each key with its prefix, who issued it, its access, its call count and when it was last used. Click the bin and confirm Revoke key. Anything still using it stops working immediately.