Authentication
Every request carries an organisation API key as a bearer token:
HTTP
GET /v1/organisation HTTP/1.1
Host: api.postbuddy.nl
Authorization: Bearer pb_live_AbCdEfGh…Keys are created in the portal under Developers by members with the apikeys.manage permission. A key has a mode and scopes.
Modes
pb_live_…keys create real items that are printed and posted.pb_test_…keys create test items: they follow the full lifecycle, trigger webhooks and never reach production or billing. Test keys only see test resources plus shared read-only ones such as products and templates.
Scopes
Scopes mirror the portal permissions, for example templates.read, templates.write, postflows.write, items.write. The reference lists the scope each operation needs. A call without the scope answers 403 insufficient_scope.
Other answers
| Status | Code | Meaning |
|---|---|---|
| 401 | api_key_invalid | The key is malformed or unknown. |
| 401 | api_key_revoked | The key was revoked in the portal. |
| 403 | organisation_suspended | The organisation is suspended; reads still work. |
| 404 | not_found | Also returned for portal-only routes that keys cannot use. |
Keep keys out of client-side code; rotate them from the portal when in doubt. Every response carries X-Request-Id; quote it when you contact support.