Skip to main content
Send your credential in the Authorization header on every resource request:
The API accepts OAuth access tokens and personal tokens. Signing into the Parkes website does not authenticate REST requests; browser session cookies are not API credentials.

​
Choose a credential

OAuth access tokens represent an authorized grant. Parkes’ CLI and iOS app use OAuth to sign you in and select an organization. Keep refresh tokens in secure storage and use the supported client’s refresh flow. Personal tokens support scripts and unattended tasks. Manage them through API access in your Parkes profile settings. Choose only the scopes your task needs and store the returned secret securely; the secret is shown only when issued. Revoke tokens that are no longer needed. Personal tokens have additional restrictions for unattended Knowledge writes: they can write only to your own namespace.

​
Organization access

Each grant and token belongs to exactly one organization, selected during authorization. The server derives the organization from the credential, so resource requests do not take an organization-selection header or a repeated organization ID in the route. For example, both organizations use GET /rest/v1/skills. The token determines which organization’s skills are returned. Authorize each additional organization separately, then switch credentials in your client. Use GET /rest/v1/me to inspect the authenticated identity and organization. An organization ID that identifies a resource is not a way to switch the token’s organization.

​
Scopes and permissions

Scopes limit what the credential may do. They do not grant ownership, organization membership, or administrator rights. Requests must satisfy both the credential’s scopes and your current permissions. Each endpoint documents its required scopes. A 401 response indicates an authentication failure; a 403 response means the request is not permitted. See errors for how to handle these responses.

​
Keep credentials private

Use HTTPS and send tokens only to the API origin. Do not place tokens in URLs, checked-in configuration, or logs. The API does not redirect resource requests to another host.