API Reference

The FlowState REST API lets scripts and other systems read your tenant’s deals, analyses and integration status, and start syncs and analyses. The same features are available to AI assistants through MCP.

Base URL


https://api.flowstate.copebit.io/v1

Routes under /tenants/{id}/ act on one tenant. {id} is your tenant id, and it must be the tenant your credential belongs to: a request for any other tenant is refused with 403.

Authentication

Every request sends a credential in the Authorization header:


curl https://api.flowstate.copebit.io/v1/tenants/<tenant-id>/features \
  -H "Authorization: Bearer <api-key>"

There are two kinds of credential:

Credential	Use it for	Accepted by
API key	Scripts and integrations	Operations that list apiKeyBearer under Authorization below
Access token	The FlowState web app, which gets it when you sign in	Every operation

Create an API key

Owners and admins manage API keys.

Open the API keys page

In the FlowState app, go to Settings → API keys and click New API key.

Name the key and choose its permissions

Enter a Name, for example the system that will use the key. Under Permissions, select only what that system needs. A key can hold only permissions that you hold yourself, and never permissions that manage members, keys, billing or the tenant itself.

Copy the key

Click Create key. The Your API key dialog shows the key once. Copy it into your secret store now, then click Done. FlowState keeps only a hash and cannot show the key again.

Use the key

Send it as Authorization: Bearer <api-key>, as in the example above.

To revoke a key, click the trash icon next to it under Active keys and confirm. Anything using the key loses access at once. When a member is removed from the tenant, the keys they created are revoked too.

To replace a key without downtime, rotate it with the rotate_api_key MCP tool or POST /tenants/{id}/keys/{prefix}/rotate: you get a new key, and the old one keeps working for 7 days.

Errors

Errors return a JSON body with error (a machine-readable code) and message. 401 means the credential is missing, invalid, expired or revoked. 403 means the credential is valid but lacks the permission, or belongs to a different tenant. For an unexpected 500, quote the error_id from detail to FlowState support.

Reference

Loading the API reference…