Base path and authentication
All public workflow endpoints live under /api/v1 and require a workspace API key sent as a bearer token.
- Send Authorization: Bearer <ALLOCORA_API_KEY> from a server-side job only.
- Use JSON request bodies and treat UUIDs from responses as stable resource identifiers.
- Permissions are checked per action, such as read:payees, write:revenues, or write:rules.
- Use /api/allocora/ping first when validating a new API key.