Skip to main content

API documentation

Introduction

The NookDocs REST API — manage projects, pages, and deployments programmatically.

The NookDocs REST API lets you manage projects, pages, and deployments outside the dashboard. Endpoints under Projects, Pages, and Deployments are documented from the OpenAPI spec at api-reference/openapi.json.

Base URL

https://api.nookdocs.com/v1

Authentication

The API uses API keys. Include your key in the Authorization header on every request.

Getting an API key

  1. Go to Settings → API Keys in the dashboard

  2. Click Create API Key, pick the scopes it needs

  3. Copy the key — it's only shown once

Name the key, then untick the scopes it shouldn't have

The NookDocs API base is https://api.nookdocs.com/v1. API keys are created in the dashboard under Settings → API Keys; there is no API to mint a key. The key (nook_...) is shown once at creation. Pass it as Authorization: Bearer <key> on every request. The machine-readable spec is api-reference/openapi.json and is bound via api.openapi in nookdocs.config.json.

Making requests

curl https://api.nookdocs.com/v1/projects \
  -H "Authorization: Bearer nook_..."

API key scopes

ScopeDescription
projects:readList and get projects
projects:writeCreate, update, delete projects; manage the project logo
pages:readList and get pages
pages:writeReserved — page writes are dashboard/Git-only today; this scope unlocks future page-write endpoints
deployments:readList deployments
deployments:triggerTrigger manual deployments
analytics:readRead the analytics overview, breakdowns, and AI & LLM insights
scimSCIM 2.0 user/group provisioning — required by the /scim/v2/* endpoints (Enterprise SSO)

Requests made with a key that lacks the required scope return 403. Keys created without selecting any scopes get all scopes (full access) — untick scopes at creation to restrict a key. Scopes can be edited later from the same Settings → API Keys list.

Key expiry

Keys can be created with an optional expiry. An expired key stops authenticating immediately — requests return 401. Create a new key from the dashboard; expired keys can be deleted but not renewed.

Rate limits

There are no hard per-minute limits enforced today — the API is subject to fair use. Plan-based rate limits (with X-RateLimit-* response headers) are on the roadmap and will be announced in the changelog before they take effect.

Was this page helpful?

Last updated August 11, 2026