Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
All 92 tools →
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/brixsignage-com:brixsignage-com-gdpr-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"
Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we
store it to create your key and to recognise you if you sign in with another
provider. See our Privacy Policy and
Terms.
A second provider on the same verified email joins the account you already have.
openapi: 3.2.0
info:
title: Brix Gdpr API
version: '1'
summary: 'Control plane for Brix digital signage: screens, content, playlists, schedules, casts and emergencies.'
description: 'Generated from the route table the API actually mounts
(`apps/api/routes.snapshot.json`), the description each route is required to
carry (`tests/contracts/route-registry.json`), and request/response schemas
(`apps/api/src/openapi/`). CI enforces all three, so this document cannot list a
route that does not exist or omit one that does.
**Schemas.** 447 operations carry request and response schemas
(`x-brix-schema: verified`). Each is checked in CI against the response the
real handler returns — a missing, mistyped or undeclared field fails the build.
The remaining operations are route-level only (`x-brix-schema: none`): their
path, method, permission and purpose are exact, but the shape of `data` is not
yet modelled, and we would rather say so than publish a schema that validates
against nothing. Objects are open: a new field is not a breaking change.
**Envelope.** Success bodies are `{ "data": … }`. Failures are
`{ "error": "", "message": "…" }`, plus `requestId` on a 5xx.
Many list routes page opt-in (see each operation): pass `?limit=` and
follow `nextCursor` via `?cursor=` until it is null.
**Authentication.** `Authorization: Bearer ` with an API key
(`ak_…`, created in the console under Settings → API & MCP) or a user session. An
API key carries a creator-chosen set of `resource.verb` permissions and may be
pinned to one location''s subtree; a key can never be granted a permission its
creator does not hold. The permission an operation needs is in
`x-brix-permission` and in its security requirement.
**Tenancy.** Every request resolves to one workspace. A resource belonging to
another tenant returns 404, never 403, so a response never confirms that an
account exists.
**Rate limits.** A 429 carries `Retry-After`; a 503 `database_busy` means retry
after the `Retry-After` interval.'
servers:
- url: https://api.brixsignage.com
description: Production
security:
- bearerAuth: []
tags:
- name: GDPR
paths:
/v1/gdpr/erase:
post:
operationId: createGdprErase
tags:
- GDPR
summary: Erase user under GDPR
description: 'Permanently anonymizes a user''s profile and deletes their associated personal data, including linked identities, passkeys, sessions, and pending email verifications, to satisfy a right-to-be-forgotten request. You cannot erase your own account or the last remaining account owner. Only an account owner can do this to an owner, and you cannot do it to a person who holds a permission you do not hold. An API key is never an owner.
**Notes.**
- Irreversible. Unlike `POST /v1/users/:id/erase`, the person does not have to be deactivated first.'
x-brix-permission: user.edit
x-brix-schema: verified
x-brix-notes:
- Irreversible. Unlike `POST /v1/users/:id/erase`, the person does not have to be deactivated first.
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
userId:
type: string
required:
- userId
responses:
'200':
description: Success.
content:
application/json:
schema:
type: object
properties:
data:
type: object
properties:
userId:
type: string
erased:
type: boolean
const: true
required:
- userId
- erased
required:
- data
'401':
description: Missing, expired or revoked bearer token.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'403':
description: 'You do not hold the permission for the whole workspace (a grant at one location, or in a franchise workspace, is not enough). Also `owner_required` or `outranked`: the person is an owner, or holds a permission you do not hold.'
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'404':
description: No such person in this workspace.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'409':
description: '`cant_erase_self` or `last_owner`.'
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'422':
description: '`userId` is missing.'
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
5XX:
description: Server error. The body carries a `requestId` to quote to support.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
security:
- bearerAuth:
- user.edit
/v1/gdpr/export:
get:
operationId: exportGdpr
tags:
- GDPR
summary: Export user data (GDPR)
description: 'Assembles a data subject access request export for the whole workspace: every person, screen and piece of content, and the last 365 days of the activity log, as one JSON file with secret values withheld. The key or person must have `billing.export` for the whole workspace. Each table is capped; `complete` is false when one was cut.
**Notes.**
- Exports the whole workspace, not one person: every person, screen and piece of content, and the last 365 days of the activity log.
- No `{ data }` envelope: the body is the export file (`Content-Disposition: attachment`).
- Credentials are never exported: their columns are kept with `null` or a `[secret; not exported]` / `[encrypted; not exported]` marker.'
x-brix-permission: billing.export
x-brix-schema: verified
x-brix-notes:
- 'Exports the whole workspace, not one person: every person, screen and piece of content, and the last 365 days of the activity log.'
- 'No `{ data }` envelope: the body is the export file (`Content-Disposition: attachment`).'
- 'Credentials are never exported: their columns are kept with `null` or a `[secret; not exported]` / `[encrypted; not exported]` marker.'
responses:
'200':
description: Success.
content:
application/json:
schema:
type: object
properties:
schemaVersion:
type: number
const: 1
generatedAt:
type: string
description: ISO-8601 timestamp (UTC).
subject:
type: object
properties:
spaceId:
type: string
description: The workspace exported.
requestedByUserId:
anyOf:
- type: string
- type: 'null'
description: Null for an API key.
required:
- spaceId
- requestedByUserId
limits:
type: object
properties:
perTable:
type: integer
description: At most this many rows per table.
auditEvents:
type: integer
description: At most this many activity log events.
auditWindowDays:
type: integer
description: Activity log events from this many days back.
required:
- perTable
- auditEvents
- auditWindowDays
truncated:
type: object
propertyNames:
type: string
additionalProperties:
type: boolean
const: true
description: The tables cut at the limit; empty when none.
complete:
type: boolean
description: False when a table was cut at the limit.
tables:
type: object
properties:
workspace:
anyOf:
- type: object
propertyNames:
type: string
additionalProperties: {}
- type: 'null'
description: The workspace record, every column (the Screen Lock PIN hash replaced by `kioskHasGlobalPin` inside `prefs`).
users:
type: array
items:
type: object
properties:
id:
type: string
name:
type: string
email:
type: string
title:
anyOf:
- type: string
- type: 'null'
phone:
anyOf:
- type: string
- type: 'null'
status:
type: string
lastLoginAt:
anyOf:
- type: string
description: ISO-8601 timestamp (UTC).
- type: 'null'
emailVerifiedAt:
anyOf:
- type: string
description: ISO-8601 timestamp (UTC).
- type: 'null'
createdAt:
type: string
description: ISO-8601 timestamp (UTC).
updatedAt:
type: string
description: ISO-8601 timestamp (UTC).
deletedAt:
anyOf:
- type: string
description: ISO-8601 timestamp (UTC).
- type: 'null'
required:
- id
- name
- email
- title
- phone
- status
- lastLoginAt
- emailVerifiedAt
- createdAt
- updatedAt
- deletedAt
screens:
type: array
items:
type: object
propertyNames:
type: string
additionalProperties: {}
description: Every column; credentials withheld, and `kioskHasCustomPin` / `kioskHasRecovery` added.
media:
type: array
items:
type: object
propertyNames:
type: string
additionalProperties: {}
playlists:
type: array
items:
type: object
propertyNames:
type: string
additionalProperties: {}
schedules:
type: array
items:
type: object
propertyNames:
type: string
additionalProperties: {}
layouts:
type: array
items:
type: object
propertyNames:
type: string
additionalProperties: {}
creatives:
type: array
items:
type: object
propertyNames:
type: string
additionalProperties: {}
appInstances:
type: array
items:
type: object
propertyNames:
type: string
additionalProperties: {}
dataSources:
type: array
items:
type: object
propertyNames:
type: string
additionalProperties: {}
description: '`config` is `[encrypted; not exported]` (or null).'
banners:
type: array
items:
type: object
propertyNames:
type: string
additionalProperties: {}
auditEvents:
type: array
items:
type: object
propertyNames:
type: string
additionalProperties: {}
description: Newest first.
required:
- workspace
- users
- screens
- media
- playlists
- schedules
- layouts
- creatives
- appInstances
- dataSources
- banners
- auditEvents
required:
- schemaVersion
- generatedAt
- subject
- limits
- truncated
- complete
- tables
'401':
description: Missing, expired or revoked bearer token.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'403':
description: You do not hold the permission for the whole workspace (a grant at one location, or in a franchise workspace, is not enough).
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
5XX:
description: Server error. The body carries a `requestId` to quote to support.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
security:
- bearerAuth:
- billing.export
post:
operationId: exportGdpr2
tags:
- GDPR
summary: Export user data (GDPR)
description: 'Same as the GET version of this operation: assembles a data subject access request export for the whole workspace as one JSON file, with secret values withheld. The key or person must have `billing.export` for the whole workspace. Takes no request body.
**Notes.**
- Exports the whole workspace, not one person: every person, screen and piece of content, and the last 365 days of the activity log.
- No `{ data }` envelope: the body is the export file (`Content-Disposition: attachment`).
- Credentials are never exported: their columns are kept with `null` or a `[secret; not exported]` / `[encrypted; not exported]` marker.
- Takes no body; the same export as the GET.'
x-brix-permission: billing.export
x-brix-schema: verified
x-brix-notes:
- 'Exports the whole workspace, not one person: every person, screen and piece of content, and the last 365 days of the activity log.'
- 'No `{ data }` envelope: the body is the export file (`Content-Disposition: attachment`).'
- 'Credentials are never exported: their columns are kept with `null` or a `[secret; not exported]` / `[encrypted; not exported]` marker.'
- Takes no body; the same export as the GET.
responses:
'200':
description: Success.
content:
application/json:
schema:
type: object
properties:
schemaVersion:
type: number
const: 1
generatedAt:
type: string
description: ISO-8601 timestamp (UTC).
subject:
type: object
properties:
spaceId:
type: string
description: The workspace exported.
requestedByUserId:
anyOf:
- type: string
- type: 'null'
description: Null for an API key.
required:
- spaceId
- requestedByUserId
limits:
type: object
properties:
perTable:
type: integer
description: At most this many rows per table.
auditEvents:
type: integer
description: At most this many activity log events.
auditWindowDays:
type: integer
description: Activity log events from this many days back.
required:
- perTable
- auditEvents
- auditWindowDays
truncated:
type: object
propertyNames:
type: string
additionalProperties:
type: boolean
const: true
description: The tables cut at the limit; empty when none.
complete:
type: boolean
description: False when a table was cut at the limit.
tables:
type: object
properties:
workspace:
anyOf:
- type: object
propertyNames:
type: string
additionalProperties: {}
- type: 'null'
description: The workspace record, every column (the Screen Lock PIN hash replaced by `kioskHasGlobalPin` inside `prefs`).
users:
type: array
items:
type: object
properties:
id:
type: string
name:
type: string
email:
type: string
title:
anyOf:
- type: string
- type: 'null'
phone:
anyOf:
- type: string
- type: 'null'
status:
type: string
lastLoginAt:
anyOf:
- type: string
description: ISO-8601 timestamp (UTC).
- type: 'null'
emailVerifiedAt:
anyOf:
- type: string
description: ISO-8601 timestamp (UTC).
- type: 'null'
createdAt:
type: string
description: ISO-8601 timestamp (UTC).
updatedAt:
type: string
description: ISO-8601 timestamp (UTC).
deletedAt:
anyOf:
- type: string
description: ISO-8601 timestamp (UTC).
- type: 'null'
required:
- id
- name
- email
- title
- phone
- status
- lastLoginAt
- emailVerifiedAt
- createdAt
- updatedAt
- deletedAt
screens:
type: array
items:
type: object
propertyNames:
type: string
additionalProperties: {}
description: Every column; credentials withheld, and `kioskHasCustomPin` / `kioskHasRecovery` added.
media:
type: array
items:
type: object
propertyNames:
type: string
additionalProperties: {}
playlists:
type: array
items:
type: object
propertyNames:
type: string
additionalProperties: {}
schedules:
type: array
items:
type: object
propertyNames:
type: string
additionalProperties: {}
layouts:
type: array
items:
type: object
propertyNames:
type: string
additionalProperties: {}
creatives:
type: array
items:
type: object
propertyNames:
type: string
additionalProperties: {}
appInstances:
type: array
items:
type: object
propertyNames:
type: string
additionalProperties: {}
dataSources:
type: array
items:
type: object
propertyNames:
type: string
additionalProperties: {}
description: '`config` is `[encrypted; not exported]` (or null).'
banners:
type: array
items:
type: object
propertyNames:
type: string
additionalProperties: {}
auditEvents:
type: array
items:
type: object
propertyNames:
type: string
additionalProperties: {}
description: Newest first.
required:
- workspace
- users
- screens
- media
- playlists
- schedules
- layouts
- creatives
- appInstances
- dataSources
- banners
- auditEvents
required:
- schemaVersion
- generatedAt
- subject
- limits
- truncated
- complete
- tables
'401':
description: Missing, expired or revoked bearer token.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'403':
description: You do not hold the permission for the whole workspace (a grant at one location, or in a franchise workspace, is not enough).
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
5XX:
description: Server error. The body carries a `requestId` to quote to support.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
security:
- bearerAuth:
- billing.export
components:
schemas:
Error:
type: object
properties:
error:
type: string
description: 'Machine-readable code: `unauthorized`, `forbidden`, `not_found`, `validation_error`, `conflict`, `rate_limited`, `internal_error`, …'
message:
description: Human-readable explanation. Safe to show an operator.
type: string
requestId:
description: 'Present on 5xx: quote it to support.'
type: string
required:
- error
additionalProperties: {}
description: Error envelope returned by every failing request.
securitySchemes:
bearerAuth:
type: http
scheme: bearer
description: An API key (`ak_…`) or a user session token. API keys carry `resource.verb` permissions.