Authentication

Creating a token

• Open Organization → API tokens
• Click Create token
• Choose a recognizable name (for example CI docs sync)
• Select scopes — destructive scopes are off by default
• Optionally limit to specific sites (required for delete and publish unless you are an admin)
• Copy the secret when shown — it is displayed only once

Store the token in your password manager or CI secrets (for example AVEIRO_API_TOKEN).

Request header

Authorization: Bearer av_live_xxxxxxxxxxxxxxxx
Content-Type: application/json

Scopes

Default token: sites:read, content:read, content:write. Delete and publish scopes require limiting the token to specific sites (non-admins).

Who can grant which scopes

Token creators can only include scopes their member permissions allow: Owners and admins can grant every scope. Members without the matching capability receive 403 when creating a token with a scope they cannot grant.

Check your token

GET /api/v1/me
Authorization: Bearer av_live_…

Example response: When site_ids is null, the token can access every site you can edit. Otherwise only the listed site IDs are allowed.

Error responses

Failed requests return JSON with a stable error.code: Common codes:

Related

• Aveiro API overview
• List sites

{
  "token": {
    "id": "3d308df4-8c1b-4cbd-af17-b124b6ec7b73",
    "name": "CI docs sync",
    "scopes": ["sites:read", "content:read", "content:write"],
    "site_ids": null
  },
  "organization": {
    "id": "org-uuid"
  },
  "created_by": "user-uuid"
}

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Invalid or missing API token"
  }
}