Authentication and Scopes

Every request carries a personal token as a bearer header. Tokens start with rvp_, are shown once when minted, and only ever leave your account as a SHA-256 hash.

Authorization: Bearer rvp_…

Minting and revoking

Settings → Developers in the dashboard. Give each token a label naming the thing that will hold it (wall dashboard, Zapier, internal tooling) and only the scopes that thing needs. Up to 20 live tokens per account, each revocable on its own. Every review action taken through the API is recorded in the account's audit log against the token's label, and block list entries added through the API carry it too.

Scopes

Scope	Lets a token
review:read	see what is waiting for you
review:write	approve, answer, send, request changes, snooze, dismiss
agent:message	message your agent and read its replies
results:read	read results, workflows and agent status
leads:read	read leads, contacts and the block list
leads:write	set vertical, archetype and tags on leads; add and remove block list entries
workflows:write	create, edit, pause, resume and delete workflows

GET /me needs no scope at all, so it works for verifying any live token.

Status codes

Code	Meaning
401	Unknown or revoked token
403	The token lacks the scope this route needs. The body names it.
404	Unknown id, or another account's id. The two are indistinguishable on purpose.
409	The action is not allowed on that card right now. The body says which are.
429	Slow down. Retry-After is in seconds.
503	Infrastructure, not your request: the token could not be checked, the limiter was down for a write, or a delivery answer was lost. Honour Retry-After and retry the same call unchanged. A 409 is never an outage; it is a settled refusal.

Keep it server-side

The API does not send CORS headers. Call it from a backend, a serverless function, a bot, or the CLI, with the token in an environment variable.