API reference

Authentication

The API authenticates with secret keys that start with mtb_. Keys belong to a workspace and carry an explicit list of scopes.

https://api.mytabulon.com/v1

Bearer keys

Send your key in the Authorization header on every request. Keys are stored hashed on our side, can expire, and can be revoked instantly from the dashboard.

header

Authorization: Bearer mtb_live_Aih3...

Scopes

Each key carries scopes like clients.read, invoices.write, accounting.expenses.write, files.write, or ai.responses. A request that needs a missing scope fails with 403 and code insufficient_scope. Grant the minimum set your integration needs.

Verifying a key

GET/meany valid key

Returns the workspace, signed-in user (including profile photo), environment, and scopes attached to your key.

response

{
  "object": "api_key.context",
  "workspace": { "object": "workspace", "id": "...", "name": "Acme", "currency": "USD" },
  "user": {
    "object": "user",
    "id": "...",
    "email": "ada@acme.com",
    "username": "ada",
    "display_name": "Ada Lovelace",
    "profile_photo_url": "https://..."
  },
  "environment": "live",
  "scopes": ["clients.read", "invoices.write", "ai.coding"]
}

GET/profileany valid key

Returns the full account profile for the user linked to the key.

PATCH/profileany valid key

Update username, name, phone, bio, and social links.

request

{
  "username": "ada",
  "first_name": "Ada",
  "last_name": "Lovelace",
  "phone": "+234...",
  "bio": "Building with Maximo Syntax"
}

POST/profile/photoany valid key

Upload a new profile photo as multipart field profilePhoto.

DELETE/profile/photoany valid key

Remove the current profile photo.

Key safety

Never ship keys in browser code or mobile apps. Keep them server-side, rotate them periodically, and create separate keys per integration so one revocation never breaks everything.