# REST API

Everything the app does goes through the same REST API you can call yourself.

## Authentication

Create a key in **Settings → API Keys** and send it as a bearer token:

```
Authorization: Bearer zb_live_...
```

Keys are workspace-scoped with three privilege tiers — **read**, **write**, or **admin** — chosen at creation. Keys are shown once and stored hashed; rotate by creating a new key and revoking the old. Requests are rate-limited per key.

## Conventions

- **Envelope** — successful responses wrap data as `{ "data": ... }`; lists include cursor-based pagination.
- **Errors** — `{ "error": { "code", "message" } }` with a stable machine-readable code.
- **Versioning** — date-based via the `X-API-Version` header (Stripe-style). Omit it to track latest; pin a date to freeze response shapes.

## Reference

The full interactive reference — every endpoint, schema, and example — lives at:

```
https://app.zerobuild.ai/api/docs
```

It's generated from the same schemas that validate requests in production, so it can't drift from reality.