Reference / API

Connect your
workspace.

Use organization-scoped API keys to read and manage records in Thunder SaaS from your own apps, automations, and services.

Base URL

`/api/v1`

Every public API request uses the versioned /api/v1 path and runs with the permissions of the user who owns the API key.

Authentication

Create a key in Workspace settings.

Open Settings → API, create an organization key, choose its scopes, and copy the secret immediately. Thunder SaaS stores only a secure hash, so the full secret is shown once.

curl https://your-workspace.example.com/api/v1/tables \
  -H "Authorization: Bearer ts_live_your_secret"

Keys are organization-bound. The API cannot switch organizations through a request parameter, and every record operation is checked against the key principal’s role and table permissions.

Endpoints

Start with tables and records.

Method	Path	Scope	Use
`GET`	`/tables`	`records:read`	List available custom tables.
`GET`	`/tables/:table/records`	`records:read`	List records. Use `limit` and `offset` for pagination.
`POST`	`/tables/:table/records`	`records:create`	Create a record with a `data` object.
`GET`	`/tables/:table/records/:recordId`	`records:read`	Read one record.
`PATCH`	`/tables/:table/records/:recordId`	`records:update`	Update fields with a `data` object.
`DELETE`	`/tables/:table/records/:recordId`	`records:delete`	Delete one record.

Examples

Use the same API for CRUD workflows.

curl -X POST https://your-workspace.example.com/api/v1/tables/contacts/records \
  -H "Authorization: Bearer ts_live_your_secret" \
  -H "Content-Type: application/json" \
  -d '{"data":{"name":"Ada Lovelace","email":"ada@example.com"}}'

curl -X PATCH https://your-workspace.example.com/api/v1/tables/contacts/records/rec_123 \
  -H "Authorization: Bearer ts_live_your_secret" \
  -H "Content-Type: application/json" \
  -d '{"data":{"status":"active"}}'

Key safety

Keep access narrow and reversible.

Grant only the scopes an integration needs: records:read, records:create, records:update, or records:delete. Revoke a key from Settings → API when it is no longer trusted. Expired and revoked keys stop working immediately.

API errors use an HTTP status with a structured response. A missing or invalid key returns 401; a missing scope returns 403; invalid paths or data return 4xx responses; unexpected server failures return 500.