Requests and responses

• Base URL: https://api.norreach.app/v1. Everything is JSON with snake_case fields; every object has id and object.
• Unknown fields are refused (400 unknown_field), so a typo never silently does nothing. A workspace id is never accepted from you — it comes from the key.
• Times are RFC 3339 in UTC; money is an integer in minor units with an ISO 4217 currency.
• Every answer carries X-Request-Id; send your own (up to 64 characters) to correlate.
• Accept-Language: sv gives Swedish error titles and details; codes stay English.
• Answers are never cached.

Calling from a browser

The API answers CORS for one web address only: these docs (https://docs.norreach.app), so Try it on each operation page can send your request from your browser. It allows the Authorization, Content-Type and Idempotency-Key headers and never credentials — no cookie ever opens the API. Any other web page is refused by the browser: call the API from your server, and never put a key in a web page.

Versioning

Within v1 changes are additive: new fields, operations and enum values. Anything breaking becomes v2. Deprecations are announced with Deprecation and Sunset headers and in the changelog at least six months ahead.