Authentication

API keys#

Create keys in Settings. A key starts with sa_, is shown once and acts as you: it reaches the workspaces you reach and sees the values you can see. Revoke a key in Settings and it stops working at once.

Send it as a bearer token, on the REST API and the MCP server alike:

curl -H "Authorization: Bearer $SYSTEMATLAS_API_KEY" https://systematlas.org/api/v1/workspaces

Access levels#

Every tool and endpoint in the reference carries one of four badges.

• PublicNo key needed: industries, schemas, search, the glossary and constructs.
• Needs a keyAny valid key. Reads of workspaces, atlases, comparisons and research runs; adding competitors and starting research.
• Write · editor keyA key from the workspace owner or a member, sent as a bearer header. Creating your workspace and uploads. Rate-limited per key.
• AdminA System Atlas admin's key. Writing the public registry directly; every other key gets 403.

The browser session#

Reads also accept your signed-in browser session, so you can open a GET endpoint in the browser while signed in and see what your agent would see. Writes never do: uploads always need a bearer key.

What a key sees#

• The same visibility tiers as the app: private values never leave a workspace the key cannot reach.
• Add public_only (MCP) or ?public=1 (REST) to a company atlas to see only what an outsider sees.
• Every private read is recorded in the workspace owner's audit log.