The REST API
Authenticate with a scoped API key, read boards, posts, roadmap, changelog, and status, and create posts and releases.
7 min read
Everything the dashboard does against your workspace data, the API does too. The base URL is https://api.signlos.com/api/v1, responses are JSON, and every response carries a success boolean.
Authentication
Create a key in Settings → API keys, choose its scopes, and copy it — the full key is shown once and stored only as a hash. Send it as a bearer token.
curl https://api.signlos.com/api/v1/boards \
-H "Authorization: Bearer sk_live_xxxxxxxxxxxxxxxxxxxx"Keys are confined to /api/v1
An API key is rejected on the dashboard and admin routes, deliberately. Otherwise a key created for one narrow scope would inherit its creator's full role everywhere else in the product.
A key never outranks its creator
A key inherits the workspace role of the person who made it, and is re-checked on every request. If that person is demoted or removed, the key immediately loses the same access. Rotate keys when someone leaves anyway — an active key belonging to a departed teammate is a key nobody is watching.
Scopes
Grant a key only the scopes it needs. A dashboard that reads votes has no reason to hold changelog:write.
| Scope | Grants |
|---|---|
boards:read | List boards and read board detail. |
posts:read | List and read posts, votes, and comments. |
posts:write | Create posts and update status, tags, and title. |
roadmap:read | Read roadmap items and their linked posts. |
changelog:read | Read published release notes. |
changelog:write | Create and publish release notes. |
status:read | Read status components and incidents. |
status:write | Open, update, and resolve incidents. |
Endpoints
| Method | Path | Scope |
|---|---|---|
| GET | /boards | boards:read |
| GET | /boards/{id} | boards:read |
| GET | /posts | posts:read |
| POST | /posts | posts:write |
| GET | /posts/{id} | posts:read |
| PATCH | /posts/{id} | posts:write |
| GET | /roadmap | roadmap:read |
| GET | /changelog | changelog:read |
| GET | /changelog/{id} | changelog:read |
| POST | /changelog | changelog:write |
| GET | /status/components | status:read |
| GET | /status/incidents | status:read |
Rate limits
100 requests per minute, per key. Over the limit you get HTTP 429 — back off and retry rather than hammering, since the window is a rolling minute.
Errors
{
"success": false,
"error": "Insufficient API key scopes. Required: posts:write",
"code": "INSUFFICIENT_SCOPES"
}| Status | Code | What went wrong |
|---|---|---|
| 401 | UNAUTHORIZED | Missing, malformed, revoked, or expired key. |
| 403 | INSUFFICIENT_SCOPES | The key is valid but lacks the scope for this route. |
| 403 | API_KEY_SCOPE | The key was used outside /api/v1. |
| 400 | VALIDATION_ERROR | The request body failed schema validation. |
| 429 | — | Rate limit exceeded. |
Public endpoints (no key)
Anything on a published portal is readable without authentication, under /api/public/{workspace}. That is what the portal itself uses, and it is the right surface for a public dashboard or a status badge.
curl https://api.signlos.com/api/public/YOUR-WORKSPACE/statusCommon questions
- How do I authenticate with the SignlOS API?
- Create a scoped API key in Settings → API keys and send it as a bearer token: Authorization: Bearer sk_live_…. Keys are accepted only on the /api/v1 endpoints.
- What is the SignlOS API rate limit?
- 100 requests per minute per API key. Exceeding it returns HTTP 429; back off and retry.
Something unclear or wrong? Tell us — or post it on our board.