MeetClique Public API

Get an API token

Bearer authentication

Send tokens in the Authorization header. Treat tokens like passwords and keep them on trusted backends only.

curl https://api.meetclique.net/v1/me \
  -H "Authorization: Bearer mc_live_..."

Scopes, personal access and workspace access

Scope checks happen per route. Workspace routes also check allowed workspace ids and current membership. Personal routes additionally require allow_personal.

• Workspace routes fail with 403 workspace_forbidden if the workspace is outside the token’s allowed set.
• If the token owner is no longer a member of the workspace, workspace routes fail even if the workspace id was originally allowed.
• Any workspace member role can create a token. Runtime access still follows the current workspace role of the token owner.
• member_readonly can read allowed workspace resources but cannot use workspace write routes.
• task_board_manager can manage workspace tasks, tracker team entries and workspace clients, but does not get admin rights on notes or calendar events.
• Workspace client write routes require owner, admin or task_board_manager.
• Workspace task updates/deletes require task owner, assignee or manager role; workspace note deletes require note owner or workspace admin; workspace calendar updates/deletes require event owner or workspace admin.

API coverage

Endpoints

curl https://api.meetclique.net/v1/me \
  -H "Authorization: Bearer mc_live_..."

curl https://api.meetclique.net/v1/workspaces/12/members \
  -H "Authorization: Bearer mc_live_..."

Error format

Error responses use a consistent JSON envelope and include a request id.

{
  "ok": false,
  "error": {
    "code": "workspace_forbidden",
    "message": "This token does not have access to this workspace.",
    "request_id": "req_..."
  }
}

• 400 malformed input or route issues.
• 401 missing, invalid, expired or revoked token.
• 403 missing scope, no personal access or forbidden workspace.
• 404 missing resource.
• 405 unsupported method.
• 409 idempotency conflict.
• 422 validation error.
• 429 rate limited.
• 500 internal error.

Rate limits and idempotency

The current implementation uses a per-IP bucket and a per-token bucket. POST requests support idempotency keys.

• Headers: X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, Retry-After.
• Idempotency-Key is supported for POST requests only.
• Idempotency keys are stored for 24 hours.