Platform API

Terraform, scripts and MCP servers manage an organization through the same API the console uses, with an API client instead of a person's login. Create one under Settings › API clients with one role (admin, security, developer or auditor) and a client secret or a public key (private_key_jwt).

Authenticate

TOKEN=$(curl -s -X POST "$MASKFLARE_TOKEN_URL" \
  -d grant_type=client_credentials -d client_id="$MASKFLARE_CLIENT_ID" -d client_secret="$MASKFLARE_CLIENT_SECRET" \
  | jq -r .access_token)
curl -s https://YOUR_GATEWAY_HOST/api/platform/v1/organizations/current/api-keys \
  -H "Authorization: Bearer $TOKEN"

Contract

• OpenAPI 3.1 at /api/platform/v1/openapi.json, browsable at /api/platform/v1/docs on your gateway. It lists exactly the operations an API client may call; members, approvals, billing and webhooks stay with people.
• The version is in the path. Within v1 changes are additive only.
• Rate limit: 600 requests per minute per client by default, with RateLimit-* headers; over it, `rate_limited` with Retry-After.
• Masking rule changes made by a client are proposals a person approves.