Everything Overlane does is available through one public HTTP API. The CLI and the web app are clients of that same API, so anything they can do, your code can do. Connectors are the other direction: optional links from Overlane to the services your team already uses.
- REST API: authentication, the date version header, errors that say whether to retry, and the OpenAPI document. The API reference lists every operation at the current version.
- API keys and rate limits: team keys with scopes, expiry, rotation and revocation, and the per-minute limit that comes from your plan.
- Webhooks: signed events with an idempotency key and a sequence, retried with exponential backoff, and how to verify them.
- TypeScript SDK: a typed client generated from the OpenAPI document.
- Docs MCP server: a public, read-only MCP server for these docs, with search, read page and list pages, and no sign-in.
- API versions: how a breaking change ships and how long an old version keeps working.
- Endpoints outside the SDK: CLI sign-in, the CI runner broker, the release signing key, the status page data, the health check and inbound webhook setup.
- Connectors: optional connectors, the encrypted tenant vault, and passthrough MCP servers.
- The approval rule: a connector write follows the autonomy gate, and what a connector sends back is data.
overlane api versions
overlane api openapi
overlane api-key list
overlane connector listCommand reference: api versions, api openapi, api-key create, webhook create and connector list.
Agent first
An agent holding a token or a key for the team can use every endpoint on these pages. Roles keep teams apart and keep a key from holding more than the member who made it. Actions that change secrets, delete data or spend money are in the safety autonomy classes: an independent agent or a person approves them, and a refusal names the class and the subject to approve. Payments and legal terms are human only.