Authentication

Team API keys

Public API routes accept a team API key as a Bearer token:

curl "https://app.felan.ai/api/v1/teams/{team-slug}" \
  -H "Authorization: Bearer bzy_team_abc123..."

Create and revoke keys from Settings → API Keys for the selected Felan team. A new key is displayed once; copy it to your secret manager before closing the dialog. Each key can access only its team’s API resources. Use the team slug shown in the dashboard URL or under Team Settings → General Settings. A request for another team slug returns 404 Not Found so the other team’s existence is not disclosed.

Felan team keys retain the bzy_team_ compatibility prefix. Other prefixes are rejected by the current public API.

Team members and invitations

Method	Endpoint	Purpose
`GET`	`/api/v1/teams/{teamSlug}/members`	List members and unexpired pending invitations
`POST`	`/api/v1/teams/{teamSlug}/invitations`	Create and email a member invitation

Both endpoints require the team’s API key. The member list returns data.members with userId, role, joinedAt, name, and email, plus data.pendingInvitations with id, email, role, expiresAt, and createdAt.

curl "https://app.felan.ai/api/v1/teams/{teamSlug}/invitations" \
  -H "Authorization: Bearer $FELAN_TEAM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"email":"teammate@example.com"}'

Invitations default to role: "member" and expire after seven days. Team keys cannot invite admins or owners: those roles return 403 with invite admins from the Felan web app. Other role values return 400. Use the web app to invite admins. Team seat limits still apply. A successful 201 response contains data.id, email, role, expiresAt, createdAt, inviteUrl, and emailSent. If email delivery fails, the invitation remains valid and emailSent is false, with emailError when available. An existing member or unexpired pending invitation returns 409.

Rate limiting

Each team API key is limited to 60 requests per minute. Authenticated responses include:

X-RateLimit-Limit
X-RateLimit-Remaining
X-RateLimit-Reset as a Unix timestamp in seconds

Requests beyond the limit return 429 Too Many Requests.

Error responses

API errors use a consistent envelope:

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Invalid API key"
  }
}

Status	Code	Meaning
400	`VALIDATION_ERROR`	A request field or parameter is invalid
401	`UNAUTHORIZED`	The Bearer token is missing, invalid, revoked, or has an unsupported prefix
402	`EXECUTION_DENIED`	The team is not currently admitted to start or resume session execution
403	`FORBIDDEN` or `cap_reached`	The requested invitation role is not allowed or the team seat limit has been reached
404	`NOT_FOUND`	The resource is missing or belongs to another team
409	`CONFLICT`	The requested create conflicts with an existing resource
429	`RATE_LIMITED`	The key exceeded its request limit
500	`INTERNAL_ERROR`	The server could not complete the request
502	`SESSION_START_FAILED`, `SESSION_PUBLISH_FAILED`, or `MESSAGE_PUBLISH_FAILED`	The runtime or inbound publisher could not accept session work

Overview

Endpoints

Authentication

Team API keys

Team members and invitations

Rate limiting

Error responses

​Team API keys

​Team members and invitations

​Rate limiting

​Error responses

Team API keys

Team members and invitations

Rate limiting

Error responses