The Noots API - what it is and isn't
Read this first: what you can build, and what deliberately isn't there yet.
Noots has a small, honest HTTP API. It exists for the things people actually asked for - reading your work from somewhere else, pushing a transcript or a meeting in, letting another tool set off one of your rules, and getting told when something happens here. It is not a general-purpose remote control for the product, and this page would rather tell you that up front than have you find out three days in.
The four surfaces
| Surface | Direction | Authenticated by |
|---|---|---|
| The v1 API | You call us | A personal token in an Authorization header. |
| Outgoing webhooks | We call you | An HMAC signature on the request we send. |
| The automation hook | You call us | A secret in the URL. |
| Monitoring intake | Your alerting tool calls us | A secret in the URL. |
The Noots Chrome extension signs itself in: you press Sign in with Noots, the ordinary login page opens, and pressing Allow gives the extension its own credential. You never see it, never paste it and never create it - so do not make a personal token for the extension. It is listed under Connected apps on the same screen, where you or the extension's own Disconnect button can revoke it.
What isn't built
All four of these are true today, and none of them is an oversight we're hiding:
- There is no OAuth app model. You cannot build an app that other Noots workspaces install and authorise. A token belongs to one person in one organization and is created by that person.
- There are no per-scope permissions. A token records
readandwritein its row, and nothing anywhere consults that record. Treat any token as full access to everything its owner can reach through the routes below. - Outgoing webhooks have no retry queue. One attempt, four seconds, and the response is not examined. If your endpoint was down, that delivery is gone - build your integration so a missed call is recoverable.
- There is no versioning policy beyond the `v1` in the path. We haven't yet promised a deprecation window, so don't infer one.
A token is not a service account. It acts as the human who made it, in the organization they made it in - so it sees the projects they can see, and it stops working the moment they stop being an active member. There is no way to get a credential with more reach than a person.
If what you want is "do this whenever that happens", check Automations first. A rule needs no code, logs every firing, and can call your webhook as one of its actions.