Returns the fixed catalog of report types that POST /api/reports can generate, each with a
display name and a description. The list is static and not paginated.
Consistency. Sent with Cache-Control: public, max-age=86400, so clients and proxies may cache
it for a day. It only changes when Jelliu ships a new report type.
Idempotency. A read with no side effects. Safe to retry.
Access
read or write. Human users need the owner, admin, member or viewer role; billing users are refused.customReports plan feature. Every plan includes it today, so this gate currently refuses nobody.Workspace API key: jl_ followed by 64 lowercase hex characters, created by the workspace owner in the
dashboard (Settings → API Keys) and sent as Authorization: Bearer jl_.... The plaintext is shown once,
at creation; Jelliu stores only a SHA-256 hash. A workspace can hold up to 25 active keys.
Operations restricted to admins or owners reject keys without the full scope with 403, and say so in
their description. No key, whatever its scope, can mint or revoke API keys or rotate a webhook secret —
that requires a signed-in owner session. A revoked key stops authenticating within about 10 seconds.
See Authentication.