API Reference
Download OpenAPI specEvery public/v1 request needs Authorization: Bearer <api key>. An org owner/admin issues a key from the Business Workspace's API Keys settings (src/app/api/orgs/api-keys/route.js), or Terraform can be pointed at one via INAYA_API_KEY. The key resolves to exactly one organization server-side (requireApiKey() in src/lib/api-keys.js) -- no request body or query parameter can ever point it at a different org.
GET/api/public/v1/evidence
Fetch the evidence trail for one business record.
GET/api/public/v1/audit/verify
Verify the calling organization's full audit-chain integrity.
GET/api/public/v1/permissions/check
Check whether a named permission gate is enabled for the calling organization.
GET, POST/api/public/v1/storage/resources
List or create storage resources (volumes / file shares).
GET, PATCH, DELETE/api/public/v1/storage/resources/{resourceId}
Read, expand the capacity of, or delete one storage resource.
GET, POST/api/public/v1/storage/snapshots
List or create point-in-time snapshots of a storage resource.
GET, DELETE/api/public/v1/storage/snapshots/{snapshotId}
Read or delete one snapshot.
GET, POST/api/public/v1/storage/backup-policies
List or create a tag-selector-scoped automated backup policy.
GET, PATCH, DELETE/api/public/v1/storage/backup-policies/{policyId}
Read, pause/resume, or delete one backup policy.
GET, POST/api/public/v1/storage/backup-plans
List or create a schedule + retention rule under a backup policy.
GET, DELETE/api/public/v1/storage/backup-plans/{planId}
Read or delete one backup plan.
GET, POST/api/public/v1/support/tickets
List a customer's tickets or create one. Needs a support API key with tickets:read / tickets:write.
GET/api/public/v1/support/tickets/{ticketId}
Read one ticket as its customer would see it.
POST/api/public/v1/support/tickets/{ticketId}/replies
Add a customer reply to a ticket (tickets:write).
POST/api/public/v1/support/tickets/{ticketId}/close
Mark a ticket resolved on behalf of its customer (tickets:write).
POST/api/public/v1/support/tickets/{ticketId}/reopen
Reopen a solved ticket (tickets:write).
POST/api/public/v1/support/tickets/{ticketId}/attachments
Attach a file to a ticket (attachments:write).
GET/api/public/v1/support/knowledge
Search published knowledge-base articles a customer may read (knowledge:read).
GET/api/public/v1/support/invoices
Read-only list of the customer's invoices from your Finance records (invoices:read).
GET/api/public/v1/support/queues
List active queue names (queues:read).
POST/api/public/v1/support/ideas
Submit an idea on behalf of a bound customer (ideas:write; customer-bound keys only).
POST/api/public/v1/support/ai/chat
Ask the AI assistant a question as a bound customer (ai:chat).
GET/api/public/v1/support/events
Ordered feed of support events for a service key (events:read).
POST/api/public/v1/support/uploads
Start a large attachment upload (attachments:write). Files up to 25 MB are sent in 3 MB chunks.
PUT, POST/api/public/v1/support/uploads/{uploadId}
Send one chunk (PUT ?index=N) or complete the upload (POST).
GET/api/integrations/identity/status
Sync status for the organization: providers, events waiting or failed, unfinished revocations, last drift report. Needs identity:read.
GET/api/integrations/identity/users/{user}
One person's membership, linked external identities and every grant with its source (external baseline, manual override, existing, temporary). Needs identity:read.
POST/api/integrations/identity/users/provision
Apply one lifecycle event (create, update, disable, enable, department or group change) for a provider, or preview it with dryRun. Needs identity:provision.
POST/api/integrations/identity/users/{user}/revoke
Revoke (mode full) or restrict (mode restrict) a person's access now. Frozen first, then sessions, credentials, permissions, sharing and break-glass are ended and each is verified. Needs identity:revoke.
POST/api/integrations/identity/users/{user}/restore
Restore a revoked or restricted person. Access is re-derived from the source, not from the old snapshot. Needs a signed-in owner or admin; a service credential is refused.
POST/api/integrations/identity/dry-run
Show exactly what an event would do, without changing anything. Needs identity:read.
POST/api/integrations/identity/reconcile
Post a directory export in chunks (snapshotId, users, last) and get a drift report when the last chunk arrives. Reports only; nothing is deleted. Needs identity:reconcile.
GET, POST/api/integrations/identity/mappings
List or create group/attribute mappings. POST needs identity:mapping. Owner can never be granted; admin is privileged and needs a human approval.
GET, POST/api/public/v1/shares
List shares, or create a link share (or a share with a member). Needs the Advanced Sharing feature enabled for the organization.
GET, DELETE/api/public/v1/shares/{shareId}
Read the access events of one share, or revoke it.
GET/api/public/v1/file-requests
List file requests (metadata only). Creating a request needs a browser, because its key pair must never exist on a server.
GET, DELETE/api/public/v1/file-requests/{requestId}
Inspect one request and its uploads, or revoke it.
GET/api/public/v1/governance/policies
Read governance, DLP or classification policies. Changes stay in the app, behind approvals.
GET/api/public/v1/governance/dlp-events
Read data-loss decisions with masked addresses.
GET, POST/api/public/v1/classification/{documentId}
Classification history for a document, or evaluate the rules for it (a dry run unless dryRun is false).
GET/api/public/v1/devices
Device inventory for the organization. Needs the Device Control feature.
GET, POST/api/public/v1/devices/{deviceId}
Read one device, or apply an action (trust, block, revoke, sign out, wipe app data, and so on).
GET/api/public/v1/endpoint-backup/health
Endpoint backup health overview. Needs the Endpoint Backup feature.
GET/api/public/v1/compliance/summary
Readiness overview by control family. Readiness only: never a certification. Needs the Compliance Readiness feature.
GET/api/public/v1/compliance/controls
Control status with computed evidence state. Read-only.