Bearer fam_…, a key minted on Console › API. It acts as its owner (a person, or an integration) and carries scopes; the operation names the scope it wants.

Every operation.

The assets operations that read (GET).

The bookings operations that read (GET).

The bookings operations that write (every method; the reads included).

The files operations that write (every method; the reads included).

The locations operations that read (GET).

The notifications operations that read (GET).

The notifications operations that write (every method; the reads included).

The qualifications operations that read (GET).

The qualifications operations that write (every method; the reads included).

The search operations that read (GET).

The tickets operations that read (GET).

The tickets operations that write (every method; the reads included).

The time off operations that read (GET).

The time off operations that write (every method; the reads included).

The users operations that read (GET).

An API key minted on the organization's console (Console › API), sent as Authorization: Bearer fam_…. The key acts as its owner — the person who minted it, or an integration (a bot account of the organization with a permission profile of its own) — with that owner's permission profile at every location. It carries scopes: all, or per resource <resource>:read (its GET operations) and <resource>:write (every operation of it, the reads included); each operation below names the scope it wants. It may expire, and it can be rotated with a day of grace.

The signed-in session (the application's own browser cookie).

false.

The machine word for the refusal (invalid_field, not_found, too_soon): what to branch on. Every word is listed under Errors.

Values: not_signed_in api_key_invalid api_key_expired insufficient_scope forbidden not_found invalid_field invalid_body missing_field plan_required rate_limited idempotency_key_reused idempotency_in_flight no_country no_policy no_approver no_bucket invalid_state comment_required comment_too_long no_attachments purged no_recipients no_valid_recipients too_many_recipients kind_invalid invalid_request attachment_missing storage_unavailable no_assignment asset_required asset_no_category floor_inactive checklist_required file_too_large file_not_found target_has_no_access not_bookable already_booked too_long too_soon too_far_ahead too_many_days multi_day_not_allowed outside_opening_hours space_closed company_closed away profile_not_allowed no_check_in_required too_early too_late off_network not_live released_no_show booking_canceled already_decided qualification_held url_invalid no_events too_many_endpoints

The word's sentence, in English: what happened, for a log or a developer.

The word's page on the reference.

The id of this API call, the Request-Id header's value: what to quote to support.

The query or body word the refusal is about, when it is about one.

The finer word under error, when there is one (unknown, type, either, window_not_a_time).

This call's id: what to quote to support (the console lists a key's calls by it).

The version of the contract that answered.

The key's quota (IETF draft 7): limit=600, remaining=<n>, reset=<seconds>.

The policy: 600;w=60.

Present and true when the reply is the stored reply of the first call with this Idempotency-Key.

No key on the request. Send Authorization: Bearer <api key>.

The bearer is not a live key: it was never minted, it was revoked, or its owner is switched off (reason: integration_inactive for a deactivated integration, owner_inactive for a deactivated person).

The key passed its expiry. Mint a new one on the console, or rotate it before it expires.

The key's scopes do not reach this operation; reason names the scope it wants (tickets:write). Mint a key with that scope, or with all.

The user the key acts as (a person, or an integration) may not do this here: their permission profile at the location does not allow it.

No such record, or none the person may see. An id of the wrong kind answers the same.

A word's value is not what it should be: param names it, reason says how (type, enum, format, unknown, id_kind, or the handler's own word).

The body is not a JSON object, or not what the operation takes; reason says why.

A required word is missing; param names it. For a choice (asset_id or area_connection_id), param names the first alternative and reason is either.

The organization's plan does not include this surface (bookings, time off), or the API itself: a key answers this on every call while its organization is off the Operations plan (reason names the plan).

Too many calls for this key in the window. Wait Retry-After seconds; the RateLimit header says when the window resets.

The Idempotency-Key was already used for a different call (another path, method or body). A key replays one call only.

The call with this Idempotency-Key is still running. Retry in a moment to receive its result.

The person has no country set, so no holidays and no time-off policy apply to them yet.

No time-off policy of the organization covers the person for this type.

Nobody is in place to approve: the request needs an approver and the organization has not named one for the person.

The organization has no file storage set up, so attachments cannot be posted.

The request is not in a state this operation may change: reason says which (decided, started).

There is nothing to write: the comment's text is empty, and a new comment carries no file and no action either.

The comment's text is longer than 2,000 characters.

The record has no attachments.

The attachments were purged: the record's files are no longer retained.

No user_ids were named.

None of the people named may be nudged about this ticket (they are not in its audience).

More people were named than a nudge may reach at once (25).

The kind is not one of the attachment kinds.

The address is incomplete: record_id, file_name and the scope (location_id or organization_id) are all needed.

No stored file answers to that address.

The file store could not be reached to sign the URL; the file is not gone. Try again shortly.

Nothing at the location answers that request for the caller: no active assignment matches the request (and the asset, for an asset request), or the caller may not raise it there.

The request is raised on an asset (level: asset) and none was named: send asset_id.

The asset has no category, so no request can be routed by it.

The area named is on a floor that is no longer available.

The request asks for a checklist to be answered when the ticket is raised, which the API does not take: raise it in the app.

The file is over the cap (200 MB).

The person the booking is for has no access to the location.

The asset or area is not bookable: its type is not set up for booking.

The window clashes with a booking that already holds the asset or area.

The window is longer than the type allows.

The window starts sooner than the type allows.

The window starts further ahead than the type allows.

The series covers more days than the type allows.

The window spans more than one day and the type allows one.

The window lies outside the location's opening hours.

The asset or area is closed for that window.

The organization is closed that day (a holiday or a closure it set).

The person is away that day (time off), so nothing is booked for them.

The person's permission profile may not book this type.

The booking's type needs no check-in.

Check-in has not opened yet; check_in_opens_at says when.

The check-in deadline passed; the booking was released.

Check-in from this network is not allowed: the person is not on the location's own network.

The booking is not live: it is pending, released, canceled or over.

The booking was released as a no-show and cannot be changed.

The booking was canceled.

The booking was already approved or rejected.

The holder already holds this kind (at this location, for a location's induction): renew the one held with PATCH /qualifications/{id} and a later valid_until.

An id of any kind: its first word says which (ticket_…, user_…, location_…).

The id of a area connection: area_connection_ + 28 hex characters. An area's connection to a location: the room as it exists there, with its floor, its outline on the plan, its bookable type.

The id of a asset: asset_ + 28 hex characters. A thing at a location that tickets are about: a machine, a door, a printer, a vehicle.

The id of a organization: organization_ + 28 hex characters. A customer account: its people, locations, plans and settings, run by its admins.

The id of a cost: cost_ + 28 hex characters. Money on a ticket: a quote, a cost, an invoice, approved against a budget.

The id of a planned ticket: planned_ticket_ + 28 hex characters. Work that recurs on a schedule at a location: an inspection, a service, a check. Created from a planned template; each occurrence is a ticket.

The id of a comment: planned_ticket_comment_ + 28 hex characters. What people write on a ticket, a planned ticket, a booking: the conversation on the thing.

The id of a visit: visit_ + 28 hex characters. One scheduled occurrence of a planned ticket: its date, its check-in, its outcome.

The id of a ticket: ticket_ + 28 hex characters. One piece of work at a location: created, accepted, scheduled, done, rated.

The id of a comment: comment_ + 28 hex characters. What people write on a ticket, a planned ticket, a booking: the conversation on the thing.

The id of a floor: floor_ + 28 hex characters. A level of a location; areas and pins sit on one.

The id of a page: page_ + 28 hex characters. A document on a section, written in blocks, with an owner, a review interval and an audience.

The id of a isolation: isolation_ + 28 hex characters. The record that a piece of plant is cut off from its energy (electricity, pressure, gas, gravity…), locked, tagged and proven isolated before anyone works on it: planned, applied, verified, removed. One isolation can protect several work permits and stays until it is removed, whatever happens to them. documentation/work-permits-v2-spec.md §1.

The id of a time-off request: time_off_request_ + 28 hex characters. A person asking for days off: a type, a range, who covers, approved or rejected by their manager.

The id of a type of time off: time_off_type_ + 28 hex characters. A type of time off the organization grants in a country: paid or not, needs proof or not, how many days a year.

The id of a location: location_ + 28 hex characters. A place the organization runs: an address with areas, assets, tickets and the people who have access there.

The id of a notification: notification_ + 28 hex characters. One line in a person's inbox: what happened, to what, by whom; read, done, snoozed.

The id of a priority: priority_ + 28 hex characters. How urgent a ticket is, with the SLA clock it starts: acceptance, first attendance, resolution.

The id of a qualification type: qualification_type_ + 28 hex characters. A kind of qualification (VCA, a NEN 3140 designation, SEP, liability insurance): who can hold it (a person or an organization), who grants it (an outside body or the employer), how long one usually lasts, and the countries it is suggested in (none: everywhere). fam. keeps one shared list; any organization adds its own, anywhere (/console/<org>/qualification-types, since 2026-10-15): documentation/qualifications-spec.md.

The id of a qualification: qualification_ + 28 hex characters. What a person or a provider holds that lets them do a kind of work, until it expires: a person's VCA, NEN 3140 designation, SEP or F-gas, an organization's VCA or its liability insurance. Granted by an outside body or by the holder's own employer. Checked before a work permit is issued. Held since 2026-10-15 (lib/qualification.js); the permit gate to come: documentation/qualifications-spec.md.

The id of a request: request_ + 28 hex characters. A ticket before it is a ticket: what a person files, from a request kind the organization set up.

The id of a booking: booking_ + 28 hex characters. One person holding one bookable thing for one window: pending, approved, checked in, released.

The id of a bookable type: bookable_type_ + 28 hex characters. A type of thing the organization makes bookable and names itself: its icon, its rules, its labels. Its KIND (fam) is an asset (ass, a pin on the plan, _10326) or an area (arc, an outline, _95), never a piece of furniture.

The id of a status: status_ + 28 hex characters. Where a ticket stands, in the organization's own words, under one of the app's six phases.

The id of a team: team_ + 28 hex characters. A named set of people in an organization, with an emoji mark; a hub audience, a grant by profile, a time-off circle.

The id of a file: file_ + 28 hex characters. A file a caller uploaded through the API (POST /files), waiting to be attached to a record by its id; unattached, it is dropped after a day.

The id of a user: user_ + 28 hex characters. A human with an account (a seat). Copy names the user or says "user" / "users", never "people"; the table is users.

The id of a event: event_ + 28 hex characters. One thing that happened (a booking created, a comment posted), delivered to every webhook endpoint subscribed to its name; retried until the endpoint answers 2xx.

The id of a work permit: work_permit_ + 28 hex characters. Written permission to do one risky job (hot work, work at height, electrical isolation, a confined space) at one place for a set time: issued by someone of the organization whose place it is, accepted by whoever leads the work, and closed when the place is handed back. Built 2026-10-15: documentation/work-permits-spec.md.

How many rows to return at most (the row says its default and its ceiling).

Where the page starts: the next_cursor of the previous reply. Opaque; leave it out for the first page.

Whether a next page exists.

The cursor of the next page; null when this is the last page.

The key's quota (IETF draft 7): limit=600, remaining=<n>, reset=<seconds>.

The policy: 600;w=60.

A booking was made: confirmed, or pending an approver (pending says which). Delivered to every endpoint subscribed to booking.created; answer 2xx within 10 seconds or it is retried.

A pending booking was approved. Delivered to every endpoint subscribed to booking.approved; answer 2xx within 10 seconds or it is retried.

A pending booking was rejected. Delivered to every endpoint subscribed to booking.rejected; answer 2xx within 10 seconds or it is retried.

A booking was canceled by its holder, or released by an admin. Delivered to every endpoint subscribed to booking.canceled; answer 2xx within 10 seconds or it is retried.

The person checked in to their booking. Delivered to every endpoint subscribed to booking.checked_in; answer 2xx within 10 seconds or it is retried.

A ticket was raised through the API (POST /tickets); data is the ticket as GET /tickets/{id} answers it. Delivered to every endpoint subscribed to ticket.created; answer 2xx within 10 seconds or it is retried.

A ticket's attributes were changed through the API; updated names them. Delivered to every endpoint subscribed to ticket.updated; answer 2xx within 10 seconds or it is retried.

A comment was posted on a ticket or a planned ticket. Delivered to every endpoint subscribed to comment.created; answer 2xx within 10 seconds or it is retried.

A time-off request was made (status is pending, or approved when no approver was needed). Delivered to every endpoint subscribed to time_off.requested; answer 2xx within 10 seconds or it is retried.

A time-off request was approved. Delivered to every endpoint subscribed to time_off.approved; answer 2xx within 10 seconds or it is retried.

A time-off request was rejected. Delivered to every endpoint subscribed to time_off.rejected; answer 2xx within 10 seconds or it is retried.

A time-off request was taken back by the person. Delivered to every endpoint subscribed to time_off.canceled; answer 2xx within 10 seconds or it is retried.

A work permit was asked for: it waits on an issuer. Delivered to every endpoint subscribed to work_permit.requested; answer 2xx within 10 seconds or it is retried.

A work permit was issued: the work may start once its lead accepts it. Delivered to every endpoint subscribed to work_permit.issued; answer 2xx within 10 seconds or it is retried.

The work under a permit was stopped: by its lead, by whoever is in charge of the place, by a gas alarm or by a stop of every permit at the location. Delivered to every endpoint subscribed to work_permit.suspended; answer 2xx within 10 seconds or it is retried.

A work permit was handed back and closed: the work is over and the place is safe again. Delivered to every endpoint subscribed to work_permit.closed; answer 2xx within 10 seconds or it is retried.

A work permit was cancelled before its work was done, or turned down before it was issued. Delivered to every endpoint subscribed to work_permit.cancelled; answer 2xx within 10 seconds or it is retried.

A work permit's time ran out before it was closed. One that ran out while the work was under way still waits to be handed back (phase is expired). Delivered to every endpoint subscribed to work_permit.expired; answer 2xx within 10 seconds or it is retried.

An isolation's locks and tags were put on. Delivered to every endpoint subscribed to isolation.applied; answer 2xx within 10 seconds or it is retried.

Every point of an isolation was proven isolated: the permits relying on it may be issued. Delivered to every endpoint subscribed to isolation.verified; answer 2xx within 10 seconds or it is retried.

An isolation's locks were taken off: the equipment may run again. Delivered to every endpoint subscribed to isolation.removed; answer 2xx within 10 seconds or it is retried.

Energy was found at a point of an isolation: it is no longer proven isolated, and the work under the permits relying on it was stopped. Delivered to every endpoint subscribed to isolation.energy_found; answer 2xx within 10 seconds or it is retried.

An isolation's locks were taken off for a test: the equipment may run, and the permits relying on it wait. Delivered to every endpoint subscribed to isolation.testing; answer 2xx within 10 seconds or it is retried.

An isolation's locks were put back on after a test. It is proven isolated again before the work goes on. Delivered to every endpoint subscribed to isolation.reapplied; answer 2xx within 10 seconds or it is retried.

A planned isolation was cancelled: its locks will never go on. Delivered to every endpoint subscribed to isolation.cancelled; answer 2xx within 10 seconds or it is retried.

Someone working under an isolation put their own lock on it (user_id). The isolation is not taken off while it is on. Delivered to every endpoint subscribed to isolation.lock_put_on; answer 2xx within 10 seconds or it is retried.

A personal lock came off an isolation: its person took it off, or an admin did while they were away (user_id is whose lock it was). Delivered to every endpoint subscribed to isolation.lock_taken_off; answer 2xx within 10 seconds or it is retried.

A qualification was added to a person or an organization; data is the qualification as GET /qualifications/{id} answers it. Delivered to every endpoint subscribed to qualification.created; answer 2xx within 10 seconds or it is retried.

A qualification was changed or renewed. Delivered to every endpoint subscribed to qualification.updated; answer 2xx within 10 seconds or it is retried.

A qualification was taken off its holder. Delivered to every endpoint subscribed to qualification.deleted; answer 2xx within 10 seconds or it is retried.

A qualification runs out soon: 60, 30 and 7 days before its last day, once each. Delivered to every endpoint subscribed to qualification.ending; answer 2xx within 10 seconds or it is retried.

A qualification ran out and was not renewed. Delivered to every endpoint subscribed to qualification.ended; answer 2xx within 10 seconds or it is retried.

Bearer fam_…, a key minted on Console › API. It acts as its owner (a person, or an integration) and carries scopes; the operation names the scope it wants.

The key needs assets:read (or all); a key without it is refused insufficient_scope.

The location's id.

The search text: a number, a name, a few words.

How many rows to return at most (the row says its default and its ceiling).

Where the page starts: the next_cursor of the previous reply. Opaque; leave it out for the first page.

Bearer fam_…, a key minted on Console › API. It acts as its owner (a person, or an integration) and carries scopes; the operation names the scope it wants.

The key needs assets:read (or all); a key without it is refused insufficient_scope.

Bearer fam_…, a key minted on Console › API. It acts as its owner (a person, or an integration) and carries scopes; the operation names the scope it wants.

The key needs tickets:read (or all); a key without it is refused insufficient_scope.

Which kind of record: on a ticket, whether it is a ticket, a planned_ticket or (among search matches) a cost; on a file's address, the record the file hangs off.

Values: page ticket planned_ticket cost cost_proposal recurrence asset area_connection location connection time_off_request work_permit isolation qualification prequalification

The id of the record the attachment hangs off (a ticket, a cost, an asset, a location …); kind says which family.

The file's stored name, as an attachment reply hands it out.

The location's id.

The organization's id.

The timeline entry's id.

Whether to check that the object exists before signing.

Whether to sign for a download (an attachment disposition) rather than an inline view.

The file name the download is saved as.

Whether to sign a tombstoned object: deleted, still retained.

The kind is not one of the attachment kinds.

The address is incomplete: record_id, file_name and the scope (location_id or organization_id) are all needed.

No stored file answers to that address.

The file store could not be reached to sign the URL; the file is not gone. Try again shortly.

Bearer fam_…, a key minted on Console › API. It acts as its owner (a person, or an integration) and carries scopes; the operation names the scope it wants.

The key needs tickets:write (or all); a key without it is refused insufficient_scope.

Which kind of record: on a ticket, whether it is a ticket, a planned_ticket or (among search matches) a cost; on a file's address, the record the file hangs off.

Values: page ticket planned_ticket cost cost_proposal recurrence asset area_connection location connection time_off_request work_permit isolation qualification prequalification

The id of the record the attachment hangs off (a ticket, a cost, an asset, a location …); kind says which family.

The location's id.

The organization's id.

The stored names of several files of one record, as an attachment reply hands them out.

The kind is not one of the attachment kinds.

The address is incomplete: record_id, file_name and the scope (location_id or organization_id) are all needed.

Bearer fam_…, a key minted on Console › API. It acts as its owner (a person, or an integration) and carries scopes; the operation names the scope it wants.

The key needs bookings:write (or all); a key without it is refused insufficient_scope.

The asset's id.

The id of the area at a location (an area connection).

The person's id.

The booking's start as local wall-clock time in the location's zone, YYYY-MM-DD HH:mm.

The booking's end, the same way.

The booking's start as an instant (instead of start_local).

The booking's end as an instant (instead of end_local).

Repeat the same hours every day up to this date: a series, not one long booking.

Book the same hours on these other days too, comma separated (YYYY-MM-DD, after the first day): a series of separate days. Wins over repeat_until_local.

The id of the person asked to approve it.

The comment's text. A mention is [@<user_id>@]@<name>[/] in the text (T for everyone at the location, A for the assigned organization); GET /tickets/{id}/mentions lists who may be named.

The person the booking is for has no access to the location.

Nobody is in place to approve: the request needs an approver and the organization has not named one for the person.

The asset or area is not bookable: its type is not set up for booking.

The window clashes with a booking that already holds the asset or area.

The window is longer than the type allows.

The window starts sooner than the type allows.

The window starts further ahead than the type allows.

The series covers more days than the type allows.

The window spans more than one day and the type allows one.

The window lies outside the location's opening hours.

The asset or area is closed for that window.

The organization is closed that day (a holiday or a closure it set).

The person is away that day (time off), so nothing is booked for them.

The person's permission profile may not book this type.

Bearer fam_…, a key minted on Console › API. It acts as its owner (a person, or an integration) and carries scopes; the operation names the scope it wants.

The key needs bookings:read (or all); a key without it is refused insufficient_scope.

How many rows to return at most (the row says its default and its ceiling).

Where the page starts: the next_cursor of the previous reply. Opaque; leave it out for the first page.

Whether to include bookings that already ended.

Bearer fam_…, a key minted on Console › API. It acts as its owner (a person, or an integration) and carries scopes; the operation names the scope it wants.

The key needs bookings:read (or all); a key without it is refused insufficient_scope.

The location's id.

The first day of the span, YYYY-MM-DD.

The last day of the span, YYYY-MM-DD.

Bearer fam_…, a key minted on Console › API. It acts as its owner (a person, or an integration) and carries scopes; the operation names the scope it wants.

The key needs bookings:read (or all); a key without it is refused insufficient_scope.

The first day of the span, YYYY-MM-DD.

The last day of the span, YYYY-MM-DD.

Bearer fam_…, a key minted on Console › API. It acts as its owner (a person, or an integration) and carries scopes; the operation names the scope it wants.

The key needs bookings:write (or all); a key without it is refused insufficient_scope.

Bearer fam_…, a key minted on Console › API. It acts as its owner (a person, or an integration) and carries scopes; the operation names the scope it wants.

The key needs bookings:write (or all); a key without it is refused insufficient_scope.

The booking's type needs no check-in.

Check-in has not opened yet; check_in_opens_at says when.

The check-in deadline passed; the booking was released.

Check-in from this network is not allowed: the person is not on the location's own network.

The booking is not live: it is pending, released, canceled or over.

The booking was released as a no-show and cannot be changed.

The booking was canceled.

Bearer fam_…, a key minted on Console › API. It acts as its owner (a person, or an integration) and carries scopes; the operation names the scope it wants.

The key needs bookings:write (or all); a key without it is refused insufficient_scope.

The comment's text. A mention is [@<user_id>@]@<name>[/] in the text (T for everyone at the location, A for the assigned organization); GET /tickets/{id}/mentions lists who may be named.

The booking was already approved or rejected.

The booking was canceled.

Bearer fam_…, a key minted on Console › API. It acts as its owner (a person, or an integration) and carries scopes; the operation names the scope it wants.

The key needs bookings:write (or all); a key without it is refused insufficient_scope.

The comment's text. A mention is [@<user_id>@]@<name>[/] in the text (T for everyone at the location, A for the assigned organization); GET /tickets/{id}/mentions lists who may be named.

The booking was already approved or rejected.

The booking was canceled.

Bearer fam_…, a key minted on Console › API. It acts as its owner (a person, or an integration) and carries scopes; the operation names the scope it wants.

The key needs tickets:write (or all); a key without it is refused insufficient_scope.

The comment's text. A mention is [@<user_id>@]@<name>[/] in the text (T for everyone at the location, A for the assigned organization); GET /tickets/{id}/mentions lists who may be named.