Authentication
Send an API key as Authorization: Bearer oos_…. Create keys in Settings → API keys (admins and owners). Keys are stored as SHA-256 hashes and shown once.
A key is bound to the organization it was created in and acts with its creator's role. Revoking a key or removing the member stops it immediately.
Roles
| Role | Can |
|---|---|
| owner | Everything, including billing and admins. |
| admin | Team, integrations, API keys, deleting workflows. |
| editor | Create and publish outcomes and workflows, run and replay executions. |
| viewer | Read-only. |
Plans
When billing is enabled on an install, API-key access requires the Business plan. Self-hosted installs without Stripe have no plan gates.