find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/fillo-so:fillo-so-credentials-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: Fillo So Credentials API
  version: 1.0.0
  contact:
    name: Fillo support
    email: hello@fillo.so
    url: https://fillo.so/developers
  description: 'Operations tagged Credentials across 2 of this provider''s published API definitions: fillo-so-openapi.json, fillo-so-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://fillo.so
security:
- bearerAuth: []
tags:
- name: Credentials
paths:
  /api/v1/manage/tokens:
    get:
      tags:
      - Credentials
      summary: List connector tokens
      operationId: listConnectorTokens
      description: 'Every `fcli_` credential bound to the key''s project — CLI logins, Zapier and n8n connectors, and agent handoffs — as metadata only. Bearers are stored as hashes and can never be listed. Tier A. Scope: workspace:manage.'
      responses:
        '200':
          description: The project's connector tokens, newest first.
          content:
            application/json:
              schema:
                type: object
                required:
                - tokens
                properties:
                  tokens:
                    type: array
                    items:
                      $ref: '#/components/schemas/CredentialSummary'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/RateLimited'
    servers:
    - url: https://fillo.so
  /api/v1/manage/tokens/{id}:
    delete:
      tags:
      - Credentials
      summary: Revoke a connector token
      operationId: revokeConnectorToken
      description: 'Revoke one connector token. Anything using it stops working immediately, so this is destructive (Tier C): `confirm` must equal the token id. An id outside the key''s project 404s. Scope: workspace:manage.'
      parameters:
      - name: id
        in: path
        required: true
        description: A token id from the connector-token listing.
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ConfirmTarget'
      responses:
        '200':
          description: The token was revoked.
          content:
            application/json:
              schema:
                type: object
                required:
                - id
                - revoked
                properties:
                  id:
                    type: string
                  revoked:
                    type: boolean
                    enum:
                    - true
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '413':
          $ref: '#/components/responses/PayloadTooLarge'
        '429':
          $ref: '#/components/responses/RateLimited'
    servers:
    - url: https://fillo.so
  /api/v1/manage/sync-tokens:
    get:
      tags:
      - Credentials
      summary: List form sync tokens
      operationId: listSyncTokens
      description: 'The project''s `fsync_` deployment credentials, as metadata only — a sync token''s plaintext is never persisted. Scope: workspace:manage.'
      responses:
        '200':
          description: The project's sync tokens, newest first.
          content:
            application/json:
              schema:
                type: object
                required:
                - tokens
                properties:
                  tokens:
                    type: array
                    items:
                      $ref: '#/components/schemas/CredentialSummary'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/RateLimited'
    post:
      tags:
      - Credentials
      summary: Mint a form sync token
      operationId: createSyncToken
      description: 'Mint a stage-only deployment credential. It can stage code-defined schema changes and nothing else: it can never publish, read responses, or manage the workspace. The plaintext is returned EXACTLY ONCE. The token is bound to the human who minted the key; if that account was removed or demoted, minting is refused with 403. Scope: workspace:manage.'
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              required: []
              properties:
                name:
                  type: string
                  maxLength: 80
                  description: What it is for, e.g. deploy or ci. Defaults to "Form sync".
      responses:
        '201':
          description: The minted token, shown once.
          content:
            application/json:
              schema:
                type: object
                required:
                - token
                - name
                properties:
                  token:
                    type: string
                    description: The `fsync_` plaintext. Shown once — store it now.
                  name:
                    type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '413':
          $ref: '#/components/responses/PayloadTooLarge'
        '429':
          $ref: '#/components/responses/RateLimited'
    servers:
    - url: https://fillo.so
  /api/v1/manage/sync-tokens/{id}:
    delete:
      tags:
      - Credentials
      summary: Revoke a form sync token
      operationId: revokeSyncToken
      description: 'Revoke one sync token; deployments using it stop staging. Destructive (Tier C): `confirm` must equal the token id. The delete holds the project''s code-sync lock, so an in-flight sync either completes or the revocation wins before it can revalidate its bearer. Scope: workspace:manage.'
      parameters:
      - name: id
        in: path
        required: true
        description: A sync token id from the sync-token listing.
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ConfirmTarget'
      responses:
        '200':
          description: The token was revoked.
          content:
            application/json:
              schema:
                type: object
                required:
                - id
                - revoked
                properties:
                  id:
                    type: string
                  revoked:
                    type: boolean
                    enum:
                    - true
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '413':
          $ref: '#/components/responses/PayloadTooLarge'
        '429':
          $ref: '#/components/responses/RateLimited'
    servers:
    - url: https://fillo.so
components:
  responses:
    NotFound:
      description: No such resource in this project (returned instead of 403 for ids in other projects).
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    RateLimited:
      description: Per-key (120/min), per-workspace (240/min), or per-IP (300/min) rate limit exceeded. Retry after the Retry-After header.
      headers:
        RateLimit-Policy:
          description: Named quota policies and their limits/windows.
          schema:
            type: string
        RateLimit:
          description: Current remaining quota and seconds until reset for each named policy.
          schema:
            type: string
        RateLimit-Limit:
          description: 'Compatibility field: effective request limit.'
          schema:
            type: integer
        RateLimit-Remaining:
          description: 'Compatibility field: effective requests remaining.'
          schema:
            type: integer
        RateLimit-Reset:
          description: 'Compatibility field: seconds until the effective window resets.'
          schema:
            type: integer
        Retry-After:
          description: Seconds to wait before retrying.
          schema:
            type: integer
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Forbidden:
      description: The key is valid but lacks the required scope.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    PayloadTooLarge:
      description: The request body exceeded the 16 KiB management cap.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Unauthorized:
      description: Missing, malformed, unknown, revoked, or expired key.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    BadRequest:
      description: Invalid request (e.g. a body on a GET/DELETE, or a missing required query parameter).
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Conflict:
      description: The request was understood but refused in this state — an unmet precondition, or a confirm value that did not match. Nothing was changed.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  schemas:
    ConfirmTarget:
      type: object
      required:
      - confirm
      properties:
        confirm:
          type: string
          description: The exact target value this operation names in its description. A boolean true is rejected by the strict schema, so a bare confirmation can never stand in for a typed one.
      description: The typed confirmation a destructive (Tier C) operation requires. A mismatch is 409 and changes nothing.
    CredentialSummary:
      type: object
      required:
      - id
      - name
      - createdAt
      - lastUsedAt
      - expiresAt
      properties:
        id:
          type: string
        name:
          type: string
        createdAt:
          type: string
          format: date-time
        lastUsedAt:
          type:
          - string
          - 'null'
          format: date-time
        expiresAt:
          type:
          - string
          - 'null'
          format: date-time
      description: Metadata for one stored credential. Bearers are stored as hashes and can never be listed.
    Error:
      type: object
      required:
      - error
      properties:
        error:
          type: string
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: 'A project secret key (`fsk_…`). Scopes: forms:read, responses:read, respondents:read, responses:export, forms:write, forms:publish, storage:manage, webhooks:manage, settings:manage, integrations:manage, responses:manage, members:manage, workspace:manage, forms:delete, responses:delete, respondents:delete, workspace:delete. A request for a scope the key lacks returns 403 with a stable message naming the scope (e.g. `This key lacks the responses:export scope.`).'
externalDocs:
  description: Fillo developer resources
  url: https://fillo.so/developers
x-refined-from:
- fillo-so-openapi.json
- fillo-so-openapi.json
x-provenance:
  method: harvested
  publisher: Fillo
  source: https://fillo.so/openapi.json
  note: split by refine-openapis from the provider's own published document, verified by fetch (openapi/_original/*.fetch.json);
    stamped by stamp-openapi-provenance.py (roadmap#793)