REST API

Quick start

1. Generate a token at /orgs/[your-slug]/settings → API tokens. Copy it once — we hash + forget the raw value.
2. Pick the scopes you need. They map onto the same permission keys as our RBAC matrix: content.read, content.create, members.read, members.invite, audit.read.
3. Bearer-authorise every request. Token cannot exceed the owner's org permissions — we re-check on every call.

Examples

curl -H "Authorization: Bearer gnk_..." \
     https://getnerdo.com/api/v1/artifacts?visibility=public

curl -X POST -H "Authorization: Bearer gnk_..." \
     -H "Content-Type: application/json" \
     -d '{"kind":"demo","title":"My RAG demo","url":"https://x.test","visibility":"public"}' \
     https://getnerdo.com/api/v1/artifacts

curl -H "Authorization: Bearer gnk_..." \
     "https://getnerdo.com/api/v1/grants?user_id=11111111-...&limit=50"

curl -X POST -H "Authorization: Bearer gnk_..." \
     -H "Content-Type: application/json" \
     -d '{"email":"new@team.com","role_slug":"instructor","members_are_adults":true}' \
     https://getnerdo.com/api/v1/invitations
# Returns raw_token ONCE — caller is responsible for emailing.

Invitations are adults-only

GetNerdo accounts are for people aged 18 or over. POST /api/v1/invitations carries the attestation in both directions:

• Request — members_are_adults (boolean, optional): send true to confirm the person you invite is 18 or older. It is stamped on the invitation (who attested, when, and the attestation version). Optional today, so existing integrations keep working — send it on every call.
• Response (201) — adults_only (always true), members_are_adults (echoes whether your attestation was recorded) and eligibility_notice (a sentence you can show next to your own invite UI).
• The invitee still confirms they are 18 or older at signup — that check is enforced on our side whatever the request says.

Spec

Full machine-readable OpenAPI 3.1 spec. Point Postman / Stoplight / Swagger UI at it.