API, MCP and command line

The API is on the Starter, Integration, Platform and Enterprise plans. The full reference, with every operation, scope and example, is on the developers page.

Three ways in

REST API

At /api/v1, described by an OpenAPI 3.1 document at /api/v1/openapi.json.

MCP server

At /api/mcp. Each operation is a tool. Assistants such as Claude sign in with OAuth instead of a pasted key.

Command line

The elsin client, for Node 24 or newer. elsin login shows a code you approve in your browser.

Keys

1. Open Settings, API and agents, and create a key.
2. Give it a role no higher than your own, and optionally narrow it with scopes.
3. Pick when it expires: 7, 30, 90 or 365 days.
4. Copy it. It is shown once, and Elsin keeps only a hash of it.

Send it as Authorization: Bearer followed by the key. A key acts as the member who made it, never above that member's current role, inside one workspace. If their role drops, every key they made drops with it.

Limits and conventions

• Each credential can burst 120 calls, refilled at 2 a second. A 429 carries Retry-After.
• Lists return data and next_cursor. Send the cursor back with a limit of up to 100.
• Send an Idempotency-Key with a write and a retry within 24 hours returns the first result.
• Every REST response carries an X-Request-Id, and every error has the same shape.

What an agent can never do

• Reject a candidate. There is no reject operation.
• Confirm a trust decision without a person, unless your workspace allows it in the app.
• See face data or ID documents. The API exposes verdicts and reasons only.
• Act unaudited. Every call is in an audit log admins can read.