# Web API

> How an app acts in a workspace: authentication, the message object and every operation.

Every call needs `Authorization: Bearer amd_bot_…` and the permission its page names. Base URL and
conventions are in the [overview](/start/overview/). The machine-readable version is the
[OpenAPI document](/openapi.json).

## The message object

The same everywhere a message is returned.

```json
{
  "id": "52f4c823-8e7f-4349-bb98-1ac8683aad13",
  "channel": "890d8292-33b6-4d9a-9f05-772c8571137e",
  "user": "e83f53c0-f56b-42a5-89e4-f18b5c9a31f4",
  "text": "Deploy finished",
  "parent_id": null,
  "mentions": [],
  "reply_count": 0,
  "created_at": "2026-11-12T19:18:43.527829+00:00",
  "edited_at": null
}
```

`text` is Markdown. `parent_id` is the thread the message replies to.

## Operations

The pages below are generated from the same description the server uses, so they cannot drift from
what the API does.