Introduction

Lists return { object: "list", data: [...], has_more, next_cursor }. Objects return { object: "customer", id, display_id, ... }. Errors return { error: { type, code, message, field? } }. The shape never changes between endpoints.

Send an API key in the Authorization header. Live keys start with pivotal_, test keys with pivotal_test_. Keys are scoped to one workspace.

List endpoints accept limit (max 100) and cursor (ISO 8601 timestamp). Pass response.next_cursor straight back as the next request’s cursor. No total counts — counting at scale is expensive and rarely needed.

DELETE returns { object: "deleted", id, display_id, deleted: true } and hides the row from subsequent reads. The record stays in the database for audit. Reach out if you need a hard delete.

id is a cuid — stable, opaque, safe in any system. display_id is a small integer used in URLs like /customers/42. Pass either to any {id} parameter. New objects always return both.