API Reference

Authentication

Overview

The There There API uses Laravel Sanctum for authentication. All API requests must include a valid bearer token in the Authorization header.

OpenAPI Specification

A machine readable OpenAPI 3.1 spec is available. You can browse it interactively or import it into tools like Postman or Insomnia.

Download openapi.yaml

The base URL for all API endpoints is https://app.therethere.com/api.

Creating API Tokens

Generate a personal access token from your workspace settings page. Each token is scoped to a single workspace, so all API requests made with that token will operate within that workspace's data.

Making Authenticated Requests

Include your token in the Authorization header as a Bearer token.

curl https://app.therethere.com/api/me \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -H "Accept: application/json"

A successful response returns your user profile:

{
    "id": 1,
    "name": "Jane Smith",
    "email": "jane@example.com",
    "avatar_url": "https://app.therethere.com/avatars/jane.jpg",
    "timezone": "America/New_York"
}

Rate Limits

The API enforces a rate limit of 60 requests per minute per authenticated user. When you exceed the limit, the API responds with a 429 Too Many Requests status code. The response includes a Retry-After header indicating how many seconds to wait before making another request.

Error Responses

The API uses standard HTTP status codes to indicate the outcome of a request.

Status Code	Meaning
`200`	Success
`201`	Resource created
`401`	Unauthenticated (missing or invalid token)
`403`	Forbidden (insufficient permissions)
`404`	Resource not found
`422`	Validation error
`429`	Rate limit exceeded

Validation errors return a JSON body with details about each failing field:

{
    "message": "The body field is required.",
    "errors": {
        "body": ["The body field is required."]
    }
}

Authentication failures return:

{
    "message": "Unauthenticated."
}

Request Headers

All requests should include the following headers:

Authorization: Bearer YOUR_API_TOKEN
Accept: application/json
Content-Type: application/json