Public surface
An API key reaches a subset of the API. Everything else answers 404, not 403.
Last updated on
The dashboard's browser session reaches every operation in the contract. An API key reaches only the ones below — the set an external script actually needs. Calling anything outside this set with an API key answers:
{ "code": "NOT_FOUND", "message": "Not found." }with HTTP status 404, on purpose: telling a key holder "this operation exists but you may not call it" would confirm the operation exists at all.
What is public today
| Resource | Operations |
|---|---|
| Posts | List, get, create, update, delete, retry a failed schedule, reschedule a schedule |
| Schedules | List (calendar view), get, delete |
| Integrations | List connected channels (GET /integrations), start a connect (POST /integrations/connect) |
| Uploads | Initiate, complete, delete, import from a URL |
| Tags | List, get |
| Usage | Summary totals (GET /usage) |
| Users | Current user (GET /users/me) |
Everything else — billing, API key management, workspace administration, account preferences, notifications, the collaboration and share surfaces, repurposing, recycle rules, media sources, the finer integration-management operations (disconnect, refresh, account picker) — is dashboard-only. It answers 404 to a key and is fully reachable with a signed-in session, which is the only caller it has.
Why the split exists
A long-lived credential that can mint more credentials, cancel a subscription, or remove a workspace member is a blast radius nobody asked for. The public set is exactly what an external script needs to read and write content; anything that manages the workspace itself stays behind a session.
An operation is internal by default. Widening the public surface is a deliberate change to the contract, not something that happens by adding a new dashboard screen.
If you are using the CLI or session auth instead
A signed-in CLI session (postonus login) is not restricted to this list — it reaches the same operations a browser session does. This restriction is specifically about API keys. If you want CLI calls scoped the same way a key is, set POSTONUS_API_KEY instead of logging in.