Skip to main content
GET
Dashboard overview

Authorizations

Authorization
string
header
required

OAuth 2.1 authorization code + PKCE (S256). Tokens are tenant-bound (company_id) and scoped. Discover endpoints via /.well-known/oauth-authorization-server.

Headers

X-Act-As-Company
string

OAuth human grants and scoped Platform API keys can act on one direct agency sub-account included in their explicit delegation. Current parent relationship, authorizing person access, child scope ceiling, and subscription eligibility are checked. Omit this header to act on the connected company. Machine client_credentials tokens do not carry delegation. Query parameters such as companyId, company_id, client, and subaccountId are not general tenant selectors where an endpoint does not explicitly document them.

Response

Success. Returns the resource envelope.

data
object
required