Getting started

The v1 API

REST over HTTPS: eight resources, two interchangeable credentials, outbound webhooks.

https://orkasa.app/api/v1

This is what the Zapier integration runs on, and what shares cores with the MCP connector.

Authentication#

Two credential types are accepted, and they are interchangeable everywhere:

Both resolve to the same brokerage and permission context, so every endpoint behaves identically whichever you present. See API keys and OAuth 2.0.

The response envelope#

Success:

{ "data": { "…": "…" }, "meta": { "next_cursor": null, "limit": 25 } }

Error:

{ "error": { "code": "validation_error", "message": "…", "details": [] } }

code is the contract — branch on it, not on the HTTP status or the message. The full table is in Errors.

Two endpoints answer flat, with no envelope, because Zapier stores the whole body: GET /me and POST /hooks.

Pagination#

List endpoints take ?limit (default 25, max 100) and ?cursor, a keyset cursor over created_at, id descending. Pass meta.next_cursor back as ?cursor= for the next page; null means the end.

The resources#

Bodies are strict#

An unrecognised field is a 422, not a silent ignore. System columns — brokerage_id, id, timestamps, public_slug — are not reachable from any payload.

Rate limit#

120 requests per minute per credential. See Rate limits.