Authentication
Every /v1 request needs a company-scoped API key as a Bearer token:
Authorization: Bearer mds_live_...
Keys are created and revoked by company admins under Settings → API Keys in
the planner. An invalid or revoked key returns 401.
Scopes
Each key carries a set of scopes. A request without the required scope returns
403 insufficient_scope. Reads need the read:* scope, writes the write:*
scope for the resource.
| Resource | Read scope | Write scope |
|---|---|---|
| Projects | read:projects | write:projects |
| Offers & offer requests | read:offers | write:offers |
| Customers | read:customers | write:customers |
| Materials & material series | read:materials | write:materials |
| Manufacturers | read:manufacturers | write:manufacturers |
| Services | read:services | write:services |
| Company | read:company | write:company |
| Analytics | read:analytics | — |
| Document generation | read:documents | — |
Data is always scoped to the key's company — you can only ever see or change your own company's records.
Rate limits
There are no enforced rate limits today. Every request is logged per key
(visible under Settings → API Keys), and limits may be introduced later —
build clients to tolerate 429 responses, keep request volume reasonable, and
prefer webhooks over polling.
Errors
| Status | error | Meaning |
|---|---|---|
| 400 | validation_error / invalid_sort | Bad body, params, or sort field |
| 401 | invalid_api_key / missing_api_key | No/!valid key |
| 403 | insufficient_scope | Key lacks the required scope |
| 404 | not_found | No such record in your company |