API Reference
Predictable resources, standard verbs, cursor pagination. Rate limits below are the ones the server actually enforces, not aspirational figures.
Bearer tokens, workspace-scoped. A token inherits the role of whoever created it — an editor's token cannot approve, regardless of what it calls. Enforced server-side, not in the client.
curl https://api.untactit.com/v1/assets \ -H "Authorization: Bearer $TOKEN"
Sign-in itself is SSO only (SAML or OIDC). We never hold a password, so there is no password endpoint and nothing to leak.
Cursor-based, not offset. Pass cursor from the previous response
until has_more is false. Up to 100 items per page.
{
"data": [ /* up to 100 items */ ],
"has_more": true,
"next_cursor": "cur_01H8X..."
}
Six resources. Role requirements are enforced by the server and named in the error when you lack permission.
| Resource | Covers | Minimum role |
|---|---|---|
assets |
List, read, create, update. Full version history per asset. | viewer / editor |
approvals |
Propose, approve, reject. Follows your workspace approval policy. | editor / approver |
deployments |
Plan, run, dry-run, and read deployment state including drift. | approver |
targets |
Connected platforms and their scope. | admin |
members |
Workspace members and role assignment. | admin |
audit |
Audit log with actor, action, and time filters. CSV export. | admin |
Errors
Errors carry a stable code you can branch on. When permission is
the problem, the response names the role that would have worked — so you can fix it
without guessing.
403 insufficient role — includes required and actual413 payload over 4 MB429 rate limited409 conflict — version changed under you{
"error": {
"code": "insufficient_role",
"message": "Approving requires the approver role.",
"required_role": "approver",
"actual_role": "editor",
"request_id": "req_01H8X..."
}
}
Include request_id in support mail and we can find the exact call
without asking you to reproduce it.
Token bucket per workspace, applied per path group. Sustained rate refills continuously; burst is what you can spend at once after idling.
Reads and asset writes. Burst of 50. Enough to sync a full inventory continuously and to save while editing without thinking about it.
Structural changes. Burst of 5. Role changes, workspace settings, and anything that alters who can do what.
Deployment, execution, external calls. Scaled to the cost of the work. A deployment is one call no matter how many machines it reaches.
Requests over 4 MB are rejected with 413. Enterprise workspaces with a concrete pattern can have limits raised — describe the workload and we will size it rather than quote a number that has nothing behind it.
No date we are willing to commit to publicly. The engine is running today; what remains is the stable contract and its deprecation guarantee. If API access is a requirement for your evaluation, tell us — that moves it up the list.
Not a separate one. Create a second workspace on the free plan and use it as your test environment — same behavior, no risk to production data.
In the path. Breaking changes ship as a new version with twelve months of overlap on the old one. Additive fields appear without notice, so parse defensively.
Yes, generated from the same source as the implementation so it cannot drift from actual behavior. A hand-maintained spec is a document that lies eventually.
Connect one workspace and see every skill, rule, and memory your team has in play — in about ten minutes.
No credit card. Works with what you already run.