Developers
Rabt is API-first: every feature is available through the public API, and Rabt's own web app uses the same API.
Public REST API
- Served at api.rabt.systems, versioned in the path (/v1/…), described by an OpenAPI specification generated from the code.
- Typed SDKs generated from the specification, TypeScript first.
- JSON with ISO 8601 times in UTC, cursor pagination and an Idempotency-Key on every create and paid operation.
- Errors as problem details with a code and a reference; rate limits per API key and per organization in the response headers.
Authentication
- API keys per organization with scopes (read or write per module), stored hashed and shown once.
- OAuth 2.1 with PKCE for third-party apps, with a scoped consent screen.
- Every call has the same permission checks, tenant isolation and audit log as the web app.
MCP server
- A remote Model Context Protocol server at api.rabt.systems/mcp, over Streamable HTTP.
- OAuth with the same scopes as the API; server-to-server integrations may use an API key.
- Tools and resources for tickets, contacts, the wallet and more, with the same permissions and rate limits.
Outbound webhooks
- Subscribe endpoints to the public events, such as message.created.
- Signed with HMAC-SHA256 in the Standard Webhooks format (webhook-id, webhook-timestamp, webhook-signature).
- Delivered with retries and exponential backoff, with a delivery log and manual redelivery.
API documentation
Every operation, its scopes and its errors, generated from the OpenAPI document.
In the Rabt app, after sign-in