Authentication

All /v1 requests require an nOps API key in the Authorization header:

Authorization: Bearer <api_key>

Creating keys

Sign in to nOps as an organization admin on Inform + Operate.
Open Settings → Security → API Keys.
Create a key and assign the permissions your integration needs.
Copy the key when shown — it is only displayed once.

Security rules

Keys are never accepted in query parameters.
Session cookies are not used on /v1 — header-only auth.
Keys are scoped to your nOps organization and cannot be used across tenants.

Scopes

Scope	Access
`cost:read`	Explorer / cost queries
`reports:read` / `reports:write`	Saved reports
`budgets:read` / `budgets:write`	Budgets and alerts
`recommendations:read`	Recommendations list
`anomalies:read`	Cost anomalies
`feed:read`	Feed runs
`scheduled-prompts:read` / `scheduled-prompts:write`	Scheduled prompts
`notifications:read` / `notifications:write`	Notification schedules
`commitments:read`	Commitments (reserved; endpoint returns `501` until released)
`cost-allocation:read` / `cost-allocation:write`	Cost Allocation showbacks, rules, and spend analytics
`explorer-dashboards:read` / `explorer-dashboards:write`	Explorer dashboards
`ai-optimization:read` / `ai-optimization:write`	AI Optimization default dashboard and anomalies
`map-manager:read` / `map-manager:write`	MAP Manager projects, resources, and accounts
`business-unit-economics:read` / `business-unit-economics:write`	Business Unit Economics models, units, items, and reports
`contract-tracker:read` / `contract-tracker:write`	Contract Tracker contracts and burndown
`mcp:read`	MCP read access (Clara agent / internal-envelope surface)
`mcp:write`	MCP write access — requires `mcp:read` as well for mutating endpoints

When creating an API key, assign the permissions your integration needs in Settings → Security → API Keys. mcp:read and mcp:write gate the Clara MCP agent surface; they do not authorize API-key /v1 calls — use the granular scopes above for programmatic API access.