Skip to main content

Synapse API

Use the same tenant-bound, versioned contract from any language. The canonical OpenAPI 3.1 document powers generated endpoint pages and both SDK type systems.
Examples use $SYNAPSE_API_URL. Use the base URL supplied for your provisioned Synapse environment rather than copying a placeholder or stale deployment URL.

First request

Versioned routes

Product contracts live under /v1. Authentication lifecycle operations live under /auth, and /health is reserved for readiness checks.

Tenant-bound auth

The credential and exact organization, app, and environment path must agree. Cross-scope resources are never discoverable.

Idempotent writes

Every durable mutation requires Idempotency-Key. Exact replays return the original response; conflicts return 409.

Cursor pages

Collection responses contain items and an opaque next_cursor, bound to the resource and filters.

Request conventions

  • Send and receive UTF-8 JSON with Content-Type: application/json.
  • Keep raw external IDs, participant tokens, share tokens, and PII out of URL paths, query strings, logs, and analytics.
  • Page limits are 1–100. Treat cursors as opaque and discard them when filters change.
  • Capture the response request ID for support without recording the request body or credential.
  • Honor Retry-After on 429 and use bounded exponential backoff for retryable transport and server failures.

Stable errors

Validation failures use 422; authentication failures use 401; valid credentials without scope use 403; missing tenant resources use non-enumerating 404; state or replay conflicts use 409. Validation details from /v1 use the structured object above. Authentication lifecycle operations keep their documented response shapes. Use the endpoint reference, review authentication and scope, or download the canonical specification.