> ## Documentation Index
> Fetch the complete documentation index at: https://docs.server.express/llms.txt
> Use this file to discover all available pages before exploring further.

# API reference

> Base URL, authentication and the response envelope for every public Server.Express endpoint. The reference pages are generated from the OpenAPI spec.

Every public endpoint is listed in the sidebar, grouped by area. Each page shows the parameters, request body, responses and, for endpoints that accept API tokens, the scope you need. You can call any of them from the playground with your own token.

## Base URL

```text theme={null}
https://my.server.express/api
```

Operation paths in the reference start at `/v1`, so `GET /v1/cloud` is `https://my.server.express/api/v1/cloud`.

## Authentication

Send a bearer credential on every authenticated request:

```bash theme={null}
curl https://my.server.express/api/v1/auth/whoami \
  -H "Authorization: Bearer $SE_TOKEN"
```

The spec defines two security schemes:

| Scheme | What it is |
| - | - |
| `apiToken` | A personal API token (`se_live_...`) from **Settings → API tokens**. It only works on operations that name a scope in `x-required-scope`, and the token has to carry that scope. |
| `bearerAuth` | A session from signing in to the client area. It covers every scope, but it's short-lived and meant for browsers. |

If you're writing a script, use `apiToken`. An operation without `x-required-scope` needs a session, and a token sent to it gets a `401`. [Authentication](https://docs.server.express/authentication.md) has the full scope list.

## Response envelope

Every JSON response uses the same shape:

```json theme={null}
{ "success": true, "data": { } }
```

```json theme={null}
{ "success": false, "error": "Invoice not found" }
```

The reference shows the `data` shape for each operation. Errors share one `ErrorResponse` schema. Read the status code to decide what to do, and treat `error` as a message for a person. [Errors and rate limits](https://docs.server.express/errors-and-rate-limits.md) covers every status and the IP-blocking rules.

## Where this comes from

These pages are generated from `openapi/public.yaml` in the Server.Express repo, the OpenAPI description of the customer-facing API. When an endpoint changes, the spec changes with it, so the reference stays in step with the server rather than with someone's memory.

If something here disagrees with what the API actually does, the API is right and the spec is a bug. Tell us and we'll fix it.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.