Request conventions
JSON in, JSON out, and the handful of rules every endpoint shares.
Base URL
https://api.crew25.com
All documented paths begin /api/v1/.
Requests
Send Content-Type: application/json on every write. Anything else is rejected with 415 and
{"error":"Use application/json"}. These rules also appear at the front of the
API reference.
Request bodies are capped at 16 KB. Larger bodies are refused before they are parsed.
Authentication
Every request carries an API key as a bearer token. There is no origin rule: the key is the credential, so keep it on your server. See authentication.
Responses
Success bodies are JSON. Every response carries Cache-Control: no-store.
Errors
Errors are always the same shape, whatever went wrong:
{ "error": "Enter a valid date." }The message is written for a person and is safe to show to one. Do not match on its text — match on the status.
| Status | Meaning |
|---|---|
400 |
Malformed JSON. |
401 |
The API key is missing, malformed or revoked. |
402 |
The organisation's subscription is inactive, so writes are closed. |
403 |
A read-only key used to write. |
404 |
No record with that identifier. |
415 |
The request was not application/json. |
422 |
Validation failed. The message names the fields, semicolon-separated. |
429 |
Rate limited. Retry after the Retry-After header. |
500 |
Something broke on our side. Safe to retry. |
Rate limits
Each API key may make 600 requests per minute, and a limited request comes back 429 with
Retry-After: 60. Cache what you read in your own app rather than polling it.