> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cantina.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# API Access

> Programmatic access to Cantina for client organizations

Cantina exposes a REST API that lets client organizations integrate Cantina data and workflows into their own tools. Use it to list repositories, retrieve findings, generate reports, manage company users, and react to events as they happen.

The endpoints available to clients are documented in the [Client API Reference](/api-reference/endpoints/companies/get-companies).

## Authentication

All API requests are authenticated with an API key issued through the **API keys** settings. The same key is used whether you're driving the API from Zapier or from your own scripts and services.

### Generating an API key

1. Sign in as a **Company Manager** and navigate to [**Settings → API keys**](https://cantina.xyz/settings/api-keys).
2. Click **Generate New API Key**.
3. Set an expiration date (required).
4. Store the key in a secret manager — it is shown only once.

You can revoke API access at any time by deleting an API key from the same **API keys** settings page.

For the full step-by-step including connecting Zaps and mapping repository IDs, see the [Cantina + Zapier Integration guide](/cantina-code/cantina-code-for-companies/cantina-+-zapier-integration/README).

### Using the key

Pass the key as a bearer token on every request:

```bash theme={null}
curl https://cantina.xyz/api/v0/companies \
  -H "Authorization: Bearer YOUR_API_KEY"
```

## Permissions

API keys inherit the permissions of the Company Manager who generated them. An endpoint that requires `manage_users`, `manage_github`, or other scoped permissions will return `403` if the issuing user does not hold those permissions on the target company.

## Use with Claude or OpenAI

The client API surface is published as an OpenAPI 3.1 specification you can hand directly to an AI assistant.

The fastest way to get an assistant up to speed is to use the **Copy Page as Markdown** button at the top of this page — it copies the full page (endpoint URL, auth instructions, and a pointer to the OpenAPI spec) into your clipboard so you can paste it straight into Claude or ChatGPT.

If you'd rather have the assistant fetch the docs itself:

* **This page:** [https://docs.cantina.xyz/for-organizations/getting-started/api-access](https://docs.cantina.xyz/for-organizations/getting-started/api-access)
* **OpenAPI spec:** [https://docs.cantina.xyz/api-reference/openapi-client.yaml](https://docs.cantina.xyz/api-reference/openapi-client.yaml)

Example prompt:

> Fetch [https://docs.cantina.xyz/for-organizations/getting-started/api-access](https://docs.cantina.xyz/for-organizations/getting-started/api-access) for auth and endpoint details, then use the linked OpenAPI spec to list the findings in repository `<repo_id>`. Authenticate with `Authorization: Bearer <my key>`.

The spec only includes the endpoints documented in the [Client API Reference](/api-reference/endpoints/client-api-reference).

## Rate limits and stability

The API surface documented under [Client API Reference](/api-reference/endpoints/companies/get-companies) is the supported public surface for client organizations. Endpoints outside that section may change without notice.