find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/fillo-so:fillo-so-workspace-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: Fillo So Workspace API
  version: 1.0.0
  contact:
    name: Fillo support
    email: hello@fillo.so
    url: https://fillo.so/developers
  description: 'Operations tagged Workspace across 2 of this provider''s published API definitions: fillo-so-openapi.json, fillo-so-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://fillo.so
security:
- bearerAuth: []
tags:
- name: Workspace
paths:
  /api/v1/manage/workspace:
    patch:
      tags:
      - Workspace
      summary: Rename the workspace
      operationId: renameWorkspace
      description: 'Rename the billing workspace. Ids, keys, member access, and every live form URL stay exactly as they are, which keeps this routine (Tier A). Scope: workspace:manage.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - name
              properties:
                name:
                  type: string
                  maxLength: 80
      responses:
        '200':
          description: The renamed workspace.
          content:
            application/json:
              schema:
                type: object
                required:
                - workspace
                properties:
                  workspace:
                    type: object
                    required:
                    - id
                    - name
                    properties:
                      id:
                        type: string
                      name:
                        type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '413':
          $ref: '#/components/responses/PayloadTooLarge'
        '429':
          $ref: '#/components/responses/RateLimited'
    servers:
    - url: https://fillo.so
  /api/v1/manage/project:
    patch:
      tags:
      - Workspace
      summary: Rename the project
      operationId: renameProject
      description: 'Rename the key''s project. The optional `project` selector exists for body-shape parity with the CLI and may only name the key''s own project by id, slug, or name — anything else 404s, including a sibling project in the same workspace. Tier A. Scope: workspace:manage.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - name
              properties:
                name:
                  type: string
                project:
                  type: string
                  description: The key's own project, by id, slug, or name.
      responses:
        '200':
          description: The renamed project.
          content:
            application/json:
              schema:
                type: object
                required:
                - project
                properties:
                  project:
                    type: object
                    required:
                    - id
                    - name
                    - slug
                    properties:
                      id:
                        type: string
                      name:
                        type: string
                      slug:
                        type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '413':
          $ref: '#/components/responses/PayloadTooLarge'
        '429':
          $ref: '#/components/responses/RateLimited'
    servers:
    - url: https://fillo.so
  /api/v1/manage/project/code-sync:
    get:
      tags:
      - Workspace
      summary: Get the code-sync policy
      operationId: getCodeSyncPolicy
      description: 'Report the code-sync policy in force for the key''s project: `publishable_key` (the browser key may stage from an allowed origin) or `trusted_only` (an authenticated sync token is required). Tier A. Scope: workspace:manage.'
      responses:
        '200':
          description: The policy in force.
          content:
            application/json:
              schema:
                type: object
                required:
                - policy
                properties:
                  policy:
                    type: string
                    enum:
                    - publishable_key
                    - trusted_only
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/RateLimited'
    patch:
      tags:
      - Workspace
      summary: Set the code-sync policy
      operationId: setCodeSyncPolicy
      description: 'Choose who may stage code-defined schemas for this project: `publishable_key` lets the browser key stage from an allowed origin, `trusted_only` requires an authenticated sync token. This changes who can act, so it is outward-facing (Tier B). The write takes the project''s code-sync lock, so it is serialized against in-flight syncs. Scope: workspace:manage.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - policy
              properties:
                policy:
                  type: string
                  enum:
                  - publishable_key
                  - trusted_only
      responses:
        '200':
          description: The policy now in force.
          content:
            application/json:
              schema:
                type: object
                required:
                - policy
                properties:
                  policy:
                    type: string
                    enum:
                    - publishable_key
                    - trusted_only
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '413':
          $ref: '#/components/responses/PayloadTooLarge'
        '429':
          $ref: '#/components/responses/RateLimited'
    servers:
    - url: https://fillo.so
  /api/v1/manage/project/origins:
    get:
      tags:
      - Workspace
      summary: List allowed sync origins
      operationId: listAllowedOrigins
      description: 'The origins the project''s publishable key may stage code-defined drafts from. An empty list means any origin. Scope: workspace:manage.'
      responses:
        '200':
          description: The current allow-list.
          content:
            application/json:
              schema:
                type: object
                required:
                - origins
                properties:
                  origins:
                    type: array
                    items:
                      type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/RateLimited'
    put:
      tags:
      - Workspace
      summary: Replace the allowed sync origins
      operationId: setAllowedOrigins
      description: 'Replace the whole allow-list. An empty array means any origin may stage with the publishable key, which widens who can act — outward-facing (Tier B). Every entry must be a bare http(s) origin, so a path, query, or credential in the value is a 400. Scope: workspace:manage.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - origins
              properties:
                origins:
                  type: array
                  items:
                    type: string
      responses:
        '200':
          description: The stored allow-list.
          content:
            application/json:
              schema:
                type: object
                required:
                - origins
                properties:
                  origins:
                    type: array
                    items:
                      type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '413':
          $ref: '#/components/responses/PayloadTooLarge'
        '429':
          $ref: '#/components/responses/RateLimited'
    servers:
    - url: https://fillo.so
  /api/v1/manage/project/identity:
    get:
      tags:
      - Workspace
      summary: Get identity-verification status
      operationId: getIdentityVerification
      description: 'Whether the project verifies respondent identities, and how many forms depend on it. Never returns the secret. Scope: workspace:manage.'
      responses:
        '200':
          description: The project's identity-verification state.
          content:
            application/json:
              schema:
                type: object
                required:
                - enabled
                - protectedFormCount
                properties:
                  enabled:
                    type: boolean
                  protectedFormCount:
                    type: integer
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/RateLimited'
    post:
      tags:
      - Workspace
      summary: Enable identity verification
      operationId: enableIdentityVerification
      description: 'Mint the project identity secret so forms can require signed identify() calls and hold unverified submissions. Outward-facing (Tier B). The plaintext is returned EXACTLY ONCE and is never retrievable again. Minting into an occupied slot is refused: verification that was already on answers `minted: false` with no `secret`, so enabling twice can never read an existing secret back. Scope: workspace:manage; the key acts as the human who minted it (403 once they are no longer an owner or admin).'
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              required: []
              properties: {}
              additionalProperties: false
        description: No input. Any key is a 400.
      responses:
        '200':
          description: Identity verification is on.
          content:
            application/json:
              schema:
                type: object
                required:
                - enabled
                - minted
                - protectedFormCount
                properties:
                  enabled:
                    type: boolean
                    enum:
                    - true
                  minted:
                    type: boolean
                  secret:
                    type: string
                    description: Present only when minted is true. Shown once — store it now.
                  protectedFormCount:
                    type: integer
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '413':
          $ref: '#/components/responses/PayloadTooLarge'
        '429':
          $ref: '#/components/responses/RateLimited'
    delete:
      tags:
      - Workspace
      summary: Disable identity verification
      operationId: disableIdentityVerification
      description: 'Delete the project identity secret. Forms that hold unverified submissions stop protecting themselves and the secret cannot be recovered, so this is destructive (Tier C): `confirm` must equal the project''s slug (a value fetched from the project read, never a word the caller already knows). Forms that still require verified respondents block the change with a 409. Scope: workspace:manage; the key acts as the human who minted it.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ConfirmTarget'
      responses:
        '200':
          description: Identity verification is off.
          content:
            application/json:
              schema:
                type: object
                required:
                - enabled
                - disabled
                properties:
                  enabled:
                    type: boolean
                    enum:
                    - false
                  disabled:
                    type: boolean
                    enum:
                    - true
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '413':
          $ref: '#/components/responses/PayloadTooLarge'
        '429':
          $ref: '#/components/responses/RateLimited'
    servers:
    - url: https://fillo.so
components:
  responses:
    NotFound:
      description: No such resource in this project (returned instead of 403 for ids in other projects).
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    RateLimited:
      description: Per-key (120/min), per-workspace (240/min), or per-IP (300/min) rate limit exceeded. Retry after the Retry-After header.
      headers:
        RateLimit-Policy:
          description: Named quota policies and their limits/windows.
          schema:
            type: string
        RateLimit:
          description: Current remaining quota and seconds until reset for each named policy.
          schema:
            type: string
        RateLimit-Limit:
          description: 'Compatibility field: effective request limit.'
          schema:
            type: integer
        RateLimit-Remaining:
          description: 'Compatibility field: effective requests remaining.'
          schema:
            type: integer
        RateLimit-Reset:
          description: 'Compatibility field: seconds until the effective window resets.'
          schema:
            type: integer
        Retry-After:
          description: Seconds to wait before retrying.
          schema:
            type: integer
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Forbidden:
      description: The key is valid but lacks the required scope.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    PayloadTooLarge:
      description: The request body exceeded the 16 KiB management cap.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Unauthorized:
      description: Missing, malformed, unknown, revoked, or expired key.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    BadRequest:
      description: Invalid request (e.g. a body on a GET/DELETE, or a missing required query parameter).
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Conflict:
      description: The request was understood but refused in this state — an unmet precondition, or a confirm value that did not match. Nothing was changed.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  schemas:
    ConfirmTarget:
      type: object
      required:
      - confirm
      properties:
        confirm:
          type: string
          description: The exact target value this operation names in its description. A boolean true is rejected by the strict schema, so a bare confirmation can never stand in for a typed one.
      description: The typed confirmation a destructive (Tier C) operation requires. A mismatch is 409 and changes nothing.
    Error:
      type: object
      required:
      - error
      properties:
        error:
          type: string
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: 'A project secret key (`fsk_…`). Scopes: forms:read, responses:read, respondents:read, responses:export, forms:write, forms:publish, storage:manage, webhooks:manage, settings:manage, integrations:manage, responses:manage, members:manage, workspace:manage, forms:delete, responses:delete, respondents:delete, workspace:delete. A request for a scope the key lacks returns 403 with a stable message naming the scope (e.g. `This key lacks the responses:export scope.`).'
externalDocs:
  description: Fillo developer resources
  url: https://fillo.so/developers
x-refined-from:
- fillo-so-openapi.json
- fillo-so-openapi.json
x-provenance:
  method: harvested
  publisher: Fillo
  source: https://fillo.so/openapi.json
  note: split by refine-openapis from the provider's own published document, verified by fetch (openapi/_original/*.fetch.json);
    stamped by stamp-openapi-provenance.py (roadmap#793)