Outline Stars API
`Stars` represent a favorited document or collection in the application sidebar. Each user has their own collection of starred items.
OpenAPI Specification
openapi: 3.0.0
info:
title: Outline AccessRequests Stars API
description: "# Introduction\n\nThe Outline API is structured in an RPC style. It enables you to\nprogramatically interact with all aspects of Outline’s data – in fact, the\nmain application is built on exactly the same API.\n\nThe API structure is available as an\n[openapi specification](https://github.com/outline/openapi) if that’s your\njam – it can be used to generate clients for most programming languages.\n\n# Making requests\n\nOutline’s API follows simple RPC style conventions where each API endpoint is\na `POST` method on `https://app.getoutline.com/api/:method`. Only HTTPS is\nsupported and all response payloads are JSON.\n\nWhen making `POST` requests, request parameters are parsed depending on\nContent-Type header. To make a call using JSON payload, you must pass\nContent-Type: application/json header, here’s an example using CURL:\n\n```\ncurl https://app.getoutline.com/api/documents.info \\\n-X 'POST' \\\n-H 'authorization: Bearer MY_API_KEY' \\\n-H 'content-type: application/json' \\\n-H 'accept: application/json' \\\n-d '{\"id\": \"outline-api-NTpezNwhUP\"}'\n```\n\nOr, with JavaScript:\n\n```javascript\nconst response = await fetch(\"https://app.getoutline.com/api/documents.info\", {\n method: \"POST\",\n headers: {\n Accept: \"application/json\",\n \"Content-Type\": \"application/json\",\n Authorization: \"Bearer MY_API_KEY\"\n }\n})\n\nconst body = await response.json();\nconst document = body.data;\n```\n\n# Authentication\n\n## API key\n\nYou can create new API keys under **Settings => API & Apps**. Be\ncareful when handling your keys as they allow full access to your data,\nyou should treat them like passwords and they should never be committed to\nsource control.\n\n### Usage\n\nTo authenticate with API, you should supply the API key as a \"Bearer\" token in the `Authorization` header\n(`Authorization: Bearer YOUR_API_KEY`).\n\nAPI keys can be revoked at any time by the creating user or an administrator of the workspace. If an API\nkey is revoked, any requests made with that key will return a `401 Unauthenticated` response.\n\n### Format\n\nAll API keys always begin with `ol_api_` followed by a random string of 38 letters and numbers.\n\n## OAuth 2.0\n\nOAuth 2.0 is a widely used protocol for authorization and authentication. It allows users\nto grant third-party _or_ internal applications access to their resources without sharing\ntheir credentials. To use OAuth 2.0 you need to follow these steps:\n\n1. Register your application under **Settings => Applications**\n2. Obtain an access token by exchanging the client credentials for an access token\n3. Use the access token to authenticate requests to the API\n\nSome API endpoints allow unauthenticated requests for public resources and\nthey can be called without authentication.\n\n# Scopes\n\nScopes are used to limit the access of an API key or application to specific resources. For example,\nan application may only need access to read documents, but not write them. Scopes can be global in\nthe case of `read` and `write` scopes, scoped to a namespace, scoped to an API endpoint, or use\nwildcard scopes like `documents.*`. Some examples of scopes that can be used are:\n\n## Global\n\n- `read`: Allows all read actions\n- `write`: Allows all read and write actions\n\n## Namespaced\n\n- `documents:read`: Allows all document read actions\n- `collections:write`: Allows all collection write actions\n\n## Endpoints\n\n- `documents.info`: Allows only one specific API method\n- `documents.*`: Allows all document API methods\n- `users.*`: Allows all user API methods\n\n# Errors\n\nAll successful API requests will be returned with a 200 or 201 status code\nand `ok: true` in the response payload. If there’s an error while making the\nrequest, the appropriate status code is returned with the error message:\n\n```\n{\n \"ok\": false,\n \"error\": \"Not Found\"\n}\n```\n\n# Pagination\n\nMost top-level API resources have support for \"list\" API methods. For instance,\nyou can list users, documents, and collections. These list methods share\ncommon parameters, taking both `limit` and `offset`.\n\nResponses will echo these parameters in the root `pagination` key, and also\ninclude a `nextPath` key which can be used as a handy shortcut to fetch the\nnext page of results. For example:\n\n```\n{\n ok: true,\n status: 200,\n data: […],\n pagination: {\n limit: 25,\n offset: 0,\n nextPath: \"/api/documents.list?limit=25&offset=25\"\n }\n}\n```\n\n# Rate limits\n\nLike most APIs, Outline has rate limits in place to prevent abuse. Endpoints\nthat mutate data are more restrictive than read-only endpoints. If you exceed\nthe rate limit for a given endpoint, you will receive a `429 Too Many Requests`\nstatus code.\n\nThe response will include a `Retry-After` header that indicates how many seconds\nyou should wait before making another request.\n\n# Policies\n\nMost API resources have associated \"policies\", these objects describe the\ncurrent authentications authorized actions related to an individual resource. It\nshould be noted that the policy \"id\" is identical to the resource it is\nrelated to, policies themselves do not have unique identifiers.\n\nFor most usecases of the API, policies can be safely ignored. Calling\nunauthorized methods will result in the appropriate response code – these can\nbe used in an interface to adjust which elements are visible.\n"
version: 0.1.0
contact:
email: hello@getoutline.com
license:
name: BSD-3-Clause
url: https://github.com/outline/openapi/blob/main/LICENSE
servers:
- url: https://app.getoutline.com/api
description: Cloud hosted
- url: https://{domain}/api
description: Self-hosted on your own server
variables:
domain:
default: example.com
security:
- BearerAuth: []
- OAuth2:
- read
- write
tags:
- name: Stars
description: '`Stars` represent a favorited document or collection in the application sidebar.
Each user has their own collection of starred items.
'
paths:
/stars.create:
post:
tags:
- Stars
summary: Create a star
description: Stars a document or collection so it appears in the users sidebar. One of either `documentId` or `collectionId` must be provided.
requestBody:
content:
application/json:
schema:
type: object
properties:
documentId:
type: string
format: uuid
collectionId:
type: string
format: uuid
index:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
data:
$ref: '#/components/schemas/Star'
policies:
type: array
items:
$ref: '#/components/schemas/Policy'
'400':
$ref: '#/components/responses/Validation'
'401':
$ref: '#/components/responses/Unauthenticated'
'403':
$ref: '#/components/responses/Unauthorized'
'404':
$ref: '#/components/responses/NotFound'
'429':
$ref: '#/components/responses/RateLimited'
operationId: starsCreate
/stars.list:
post:
tags:
- Stars
summary: List all stars
description: List all starred documents for the authenticated user. Stars allow users to bookmark important documents for quick access in the sidebar.
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/Pagination'
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
data:
type: object
properties:
stars:
type: array
items:
$ref: '#/components/schemas/Star'
documents:
type: array
items:
$ref: '#/components/schemas/Document'
pagination:
$ref: '#/components/schemas/Pagination'
policies:
type: array
items:
$ref: '#/components/schemas/Policy'
'401':
$ref: '#/components/responses/Unauthenticated'
'403':
$ref: '#/components/responses/Unauthorized'
'429':
$ref: '#/components/responses/RateLimited'
operationId: starsList
/stars.update:
post:
tags:
- Stars
summary: Update a stars order in the sidebar
description: Update the position of a starred document in the sidebar. The index parameter determines the display order relative to other starred documents.
requestBody:
content:
application/json:
schema:
type: object
properties:
id:
type: string
format: uuid
index:
type: string
required:
- id
- index
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
data:
$ref: '#/components/schemas/Star'
policies:
type: array
items:
$ref: '#/components/schemas/Policy'
'400':
$ref: '#/components/responses/Validation'
'401':
$ref: '#/components/responses/Unauthenticated'
'403':
$ref: '#/components/responses/Unauthorized'
'404':
$ref: '#/components/responses/NotFound'
'429':
$ref: '#/components/responses/RateLimited'
operationId: starsUpdate
/stars.delete:
post:
tags:
- Stars
summary: Delete a star
description: Remove a star from a document, removing it from the user's starred documents list in the sidebar.
requestBody:
content:
application/json:
schema:
type: object
properties:
id:
type: string
format: uuid
required:
- id
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
success:
type: boolean
example: true
'400':
$ref: '#/components/responses/Validation'
'401':
$ref: '#/components/responses/Unauthenticated'
'403':
$ref: '#/components/responses/Unauthorized'
'404':
$ref: '#/components/responses/NotFound'
'429':
$ref: '#/components/responses/RateLimited'
operationId: starsDelete
components:
headers:
RateLimit-Reset:
schema:
type: string
description: Timestamp in the future the duration will reset.
RateLimit-Remaining:
schema:
type: integer
description: How many requests are left in the current duration.
Retry-After:
schema:
type: integer
description: Seconds in the future to retry the request, if rate limited.
RateLimit-Limit:
schema:
type: integer
description: The maximum requests available in the current duration.
schemas:
User:
type: object
properties:
id:
type: string
description: Unique identifier for the object.
readOnly: true
format: uuid
name:
type: string
description: The name of this user, it is migrated from Slack or Google Workspace when the SSO connection is made but can be changed if necessary.
example: Jane Doe
avatarUrl:
type: string
format: uri
description: The URL for the image associated with this user, it will be displayed in the application UI and email notifications.
color:
type: string
description: A color representing the user, used in the UI for avatars without an image.
readOnly: true
email:
type: string
description: The email associated with this user, it is migrated from Slack or Google Workspace when the SSO connection is made but can be changed if necessary.
format: email
readOnly: true
role:
$ref: '#/components/schemas/UserRole'
isSuspended:
type: boolean
description: Whether this user has been suspended.
readOnly: true
lastActiveAt:
type: string
nullable: true
description: The last time this user made an API request, this value is updated at most every 5 minutes.
readOnly: true
format: date-time
timezone:
type: string
nullable: true
description: The timezone this user has registered.
createdAt:
type: string
description: The date and time that this user first signed in or was invited as a guest.
readOnly: true
format: date-time
updatedAt:
type: string
description: The date and time that this user was last updated.
readOnly: true
format: date-time
deletedAt:
type: string
nullable: true
description: The date and time that this user was deleted, if applicable.
readOnly: true
format: date-time
UserRole:
type: string
enum:
- admin
- member
- viewer
- guest
Document:
type: object
properties:
id:
type: string
description: Unique identifier for the object.
readOnly: true
format: uuid
collectionId:
type: string
description: Identifier for the associated collection.
format: uuid
nullable: true
parentDocumentId:
type: string
description: Identifier for the document this is a child of, if any.
format: uuid
nullable: true
title:
type: string
description: The title of the document.
example: Welcome to Acme Inc
fullWidth:
type: boolean
description: Whether this document should be displayed in a full-width view.
icon:
type: string
nullable: true
description: An emoji or icon associated with the document.
example: 🎉
color:
type: string
nullable: true
description: The color of the document icon in hex format.
text:
type: string
description: The text content of the document, contains markdown formatting
example: …
data:
type: object
nullable: true
description: The body of the document as a Prosemirror document, returned in place of text when requested.
url:
type: string
description: A URL path to access the document.
readOnly: true
urlId:
type: string
description: A short unique ID that can be used to identify the document as an alternative to the UUID
example: hDYep1TPAM
collaboratorIds:
type: array
description: Identifiers of users who have edited the document.
items:
type: string
format: uuid
tasks:
type: object
description: Task completion counts for the document.
properties:
completed:
type: number
total:
type: number
templateId:
type: string
description: Unique identifier for the template this document was created from, if any
format: uuid
revision:
type: number
description: A number that is auto incrementing with every revision of the document that is saved
readOnly: true
createdAt:
type: string
description: The date and time that this object was created
readOnly: true
format: date-time
createdBy:
$ref: '#/components/schemas/User'
updatedAt:
type: string
description: The date and time that this object was last changed
readOnly: true
format: date-time
updatedBy:
$ref: '#/components/schemas/User'
publishedAt:
type: string
nullable: true
description: The date and time that this object was published
readOnly: true
format: date-time
dataAttributes:
type: array
nullable: true
items:
$ref: '#/components/schemas/DocumentDataAttribute'
archivedAt:
type: string
nullable: true
description: The date and time that this object was archived
readOnly: true
format: date-time
deletedAt:
type: string
nullable: true
description: The date and time that this object was deleted
readOnly: true
format: date-time
Error:
type: object
properties:
ok:
type: boolean
example: false
error:
type: string
message:
type: string
status:
type: number
data:
type: object
DocumentDataAttribute:
type: object
properties:
dataAttributeId:
type: string
description: Unique identifier for the associated data attribute.
format: uuid
value:
description: The value of the data attribute for this document.
example: In Progress
oneOf:
- type: string
- type: boolean
- type: number
updatedAt:
type: string
description: The date and time that this object attribute was last changed
readOnly: true
format: date-time
Policy:
type: object
properties:
id:
type: string
description: Unique identifier for the object this policy references.
format: uuid
readOnly: true
abilities:
type: object
description: The abilities that are allowed by this policy, if an array is returned then the individual ID's in the array represent the memberships that grant the ability.
additionalProperties:
$ref: '#/components/schemas/Ability'
example:
read: true
update: true
delete: false
Ability:
description: A single permission granted by a policy
example: true
oneOf:
- type: array
items:
type: string
- type: boolean
Star:
type: object
properties:
id:
type: string
description: Unique identifier for the object.
readOnly: true
format: uuid
index:
type: string
description: Index of the star in the list of stars.
documentId:
type: string
description: Unique identifier for the starred document.
readOnly: true
format: uuid
nullable: true
collectionId:
type: string
description: Unique identifier for the starred collection.
readOnly: true
format: uuid
nullable: true
createdAt:
type: string
format: date-time
description: Date and time when this star was created
readOnly: true
updatedAt:
type: string
format: date-time
description: Date and time when this star was last changed
readOnly: true
Pagination:
type: object
properties:
offset:
type: number
example: 0
limit:
type: number
example: 25
responses:
NotFound:
description: The specified resource was not found.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
Unauthenticated:
description: The API key is missing or otherwise invalid.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
Unauthorized:
description: The current API key is not authorized to perform this action.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
RateLimited:
description: The request was rate limited.
headers:
Retry-After:
$ref: '#/components/headers/Retry-After'
RateLimit-Limit:
$ref: '#/components/headers/RateLimit-Limit'
RateLimit-Remaining:
$ref: '#/components/headers/RateLimit-Remaining'
RateLimit-Reset:
$ref: '#/components/headers/RateLimit-Reset'
content:
application/json:
schema:
type: object
properties:
ok:
type: boolean
example: false
error:
type: string
example: rate_limit_exceeded
status:
type: number
example: 429
Validation:
description: The request failed one or more validations.
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
securitySchemes:
BearerAuth:
type: http
scheme: bearer
bearerFormat: JWT
OAuth2:
type: oauth2
flows:
authorizationCode:
authorizationUrl: https://app.getoutline.com/oauth/authorize
tokenUrl: https://app.getoutline.com/oauth/token
refreshUrl: https://app.getoutline.com/oauth/token
scopes:
read: Read access
write: Write access