Buyer-side developer
Use the tenant API with narrow scopes and repeatable requests
FlowOS exposes a tenant-scoped API for workflows, manual runs, events, execution lookup, forms, submissions, leads, API key metadata, webhook metadata, and OpenAPI. Use the interactive API documentation as the contract for the installed version.
Before you start
- Developer permissions in the target tenant.
- A test client that can protect bearer tokens.
- The workspace slug.
#Create a narrow, expiring key
- Name the client or integration that owns the key.
- Select only the scopes needed for its requests.
- Set an expiry appropriate to the integration lifecycle.
- Copy the plaintext token once into an approved secret store.
- Record an owner and rotation date.
#Use OpenAPI and Postman
Open Developer → API Docs or request /api/v1/{workspace}/openapi.json. Confirm the workspace path, bearer authentication, scope, request schema, response schema, and documented error cases before coding.
curl -H "Authorization: Bearer $FLOWOS_TOKEN" -H "Accept: application/json" https://flowos.example.test/api/v1/demo/workflows#Make writes repeatable
For manual runs, events, lead creation, or submissions, send only supported fields and use an idempotency value where the contract provides one. Handle validation, unauthorized, forbidden, not-found, rate-limit, and server responses explicitly. Do not retry every failure automatically.
#Common mistakes
- Creating one broad permanent key for several clients.
- Putting the token in source control or browser code.
- Ignoring workspace path and idempotency.
#Verify the result
- The key has an owner, minimum scope, and expiry.
- The client follows the installed OpenAPI contract.
- Errors and rate limits are handled.
- Logs redact the bearer token.