> ## Documentation Index
> Fetch the complete documentation index at: https://docs.no-tickets.com/llms.txt
> Use this file to discover all available pages before exploring further.

# REST API reference

> Programmatic access to no-tickets — push specs, read activity, manage projects.

The no-tickets REST API is how the CLI, dashboard, and integrations talk to
`no-tickets-service`. Everything you can do in the dashboard you can do with the
API.

## Authentication

| Auth mode   | Used by                          | Header                               |
| ----------- | -------------------------------- | ------------------------------------ |
| **Session** | Dashboard SPA                    | Cookie (set by the OAuth login flow) |
| **Bearer**  | CLI, CI integrations, MCP server | `Authorization: Bearer <push token>` |
| **None**    | Public health + waitlist signup  | —                                    |

Push tokens are issued per project from the dashboard. Treat them like
credentials — anyone holding a push token can write to that project's feed.

## Base URL

```
https://api.no-tickets.com
```

The CLI defaults to this; override with `NT_API_URL` for self-hosted or staging
environments.

## Versioning

Every route lives under `/v1/`. The version increments only on breaking
changes; additive field changes ship within `v1`. There is no `v2` today and no
plan to cut one in the near term.

## Response envelopes

* **Success**: the resource shape directly (no wrapping envelope).
* **Validation failures (422)**: `{ "error": "ValidationError", "details": [...] }` on `POST`,
  `{ "error": "ValidationError" }` (no `details`) on `PATCH`. The asymmetry is
  intentional — `PATCH` requests are sparse and the per-field errors aren't
  always meaningful.
* **Auth failures (401, 403)**: `{ "error": "<reason>" }`. The one exception is
  `403 EntitlementExceeded`, which adds an `entitlement` field naming the
  breached limit: `{ "error": "EntitlementExceeded", "entitlement": "projects" }`.

## Rate limits

Per-token limits apply to write routes (`POST`, `PATCH`, `DELETE`). The default
ceiling is 60 req/min — high enough that normal CI usage never hits it, low
enough that a misconfigured loop won't melt the server. Limits are not
documented per-route because they apply to the token, not the endpoint.

## What's next

Browse the **Endpoints** section in the sidebar for the full operation list.
Each page includes request/response shapes pulled directly from the server's
zod schemas, plus a "Try it" playground that runs against the live API.