Send the Authorization: Bearer <key> header on every call. An invalid key answers 401; a valid key without the endpoint's scope answers 403.
The header
Every request to the external API carries the Authorization header with the value "Bearer" followed by the key. The base URL and the interactive reference are on the API documentation page; the OpenAPI 3.1 specification is at /openapi.json and can be imported into Postman, Bruno or your language's client generator.
Response codes
With no header or an invalid or revoked key, the response is 401. With a valid key that lacks the scope the endpoint requires (for example, POST /employees without employees:write), the response is 403 and the body says which scope is missing. Validation errors come back as 422 with the list of fields and messages, in the language of the Accept-Language header.
Language and format
Send Accept-Language (pt-BR, en, es, de or ru) to receive translated error messages. Dates go in and out in ISO 8601, monetary amounts as decimal numbers with the currency alongside, and list responses are paginated.