Synapse API
Use the same tenant-bound, versioned contract from any language. The canonical OpenAPI 3.1 document powers generated endpoint pages and both SDK type systems.Examples use
$SYNAPSE_API_URL. Use the base URL supplied for your
provisioned Synapse environment rather than copying a placeholder or stale
deployment URL.First request
Versioned routes
Product contracts live under
/v1. Authentication lifecycle operations
live under /auth, and /health is reserved for readiness checks.Tenant-bound auth
The credential and exact organization, app, and environment path must
agree. Cross-scope resources are never discoverable.
Idempotent writes
Every durable mutation requires
Idempotency-Key. Exact replays return
the original response; conflicts return 409.Cursor pages
Collection responses contain
items and an opaque next_cursor, bound
to the resource and filters.Request conventions
- Send and receive UTF-8 JSON with
Content-Type: application/json. - Keep raw external IDs, participant tokens, share tokens, and PII out of URL paths, query strings, logs, and analytics.
- Page limits are 1–100. Treat cursors as opaque and discard them when filters change.
- Capture the response request ID for support without recording the request body or credential.
- Honor
Retry-Afteron429and use bounded exponential backoff for retryable transport and server failures.
Stable errors
422; authentication failures use 401; valid
credentials without scope use 403; missing tenant resources use
non-enumerating 404; state or replay conflicts use 409. Validation
details from /v1 use the structured object above. Authentication lifecycle
operations keep their documented response shapes.
Use the endpoint reference, review
authentication and scope, or
download the canonical specification.