Developers & API

A small, real, read-only API -- two endpoints, both documented below with working examples. Plus OAuth applications and outgoing webhooks for anything that needs delegated access or real-time events.

Authentication

Create an API key from your organization's Settings page. Every key is scoped to specific permissions (at minimum, projects:view for the two endpoints below), can be restricted to a list of IP addresses, and can be given an expiration date. Send it as a bearer token:

Authorization: Bearer bak_your_api_key

`GET /api/v1/projects`

Lists your organization's projects (up to 200, most recently created first), including each project's latest processing status.

cURL

curl https://api.briefant.com/api/v1/projects \
  -H "Authorization: Bearer bak_your_api_key"

JavaScript

const res = await fetch("https://api.briefant.com/api/v1/projects", {
  headers: { Authorization: "Bearer bak_your_api_key" },
});
const projects = await res.json();

Python

import httpx

resp = httpx.get(
    "https://api.briefant.com/api/v1/projects",
    headers={"Authorization": "Bearer bak_your_api_key"},
)
projects = resp.json()

Response

[
  {
    "id": "b3f1...e02a",
    "name": "Weekly sync",
    "template_id": null,
    "created_at": "2026-09-01T10:00:00Z",
    "latest_job_status": "completed"
  }
]

`GET /api/v1/projects/{project_id}/document`

Returns the most recently generated document for a project. 404s if the project has no completed document yet.

cURL

curl https://api.briefant.com/api/v1/projects/PROJECT_ID/document \
  -H "Authorization: Bearer bak_your_api_key"

Response

{
  "id": "9a21...c4f0",
  "job_id": "7cd8...11b2",
  "title": "Weekly sync -- 2026-09-01",
  "document": {
    "key_decisions": ["..."],
    "action_items": ["..."]
  },
  "created_at": "2026-09-01T10:42:00Z"
}

OAuth applications

Register an application from Settings to let it act on a member's behalf with a scoped slice of their own permissions -- for example, an internal tool your team builds that reads project data as whoever is logged into it. Uses the standard OAuth 2.0 Authorization Code flow with PKCE (S256 required); confidential (web) applications receive a client secret, native and single-page applications are treated as public clients (PKCE only, no secret).

✓An OAuth token's effective permissions are always the intersection of its granted scope and the granting user's live permissions -- re-checked on every request, so a demoted user's connected apps lose access immediately too.
✓Scoped to a single organization -- a token issued for one organization can never read another's data.
✓Tokens are opaque and instantly revocable, not long-lived self-contained JWTs.

GET  https://api.briefant.com/oauth/authorize   -- start authorization
POST https://api.briefant.com/oauth/authorize   -- user approves/denies
POST https://api.briefant.com/oauth/token       -- exchange code for a token
POST https://api.briefant.com/oauth/revoke      -- revoke a token

Outgoing webhooks

Register an HTTPS endpoint from Settings and Briefant sends a signed POST request whenever one of the events below happens. Failed deliveries retry automatically (five attempts, backing off over several hours) and every delivery attempt -- successful or not -- is visible in a delivery log.

Projects

project.created
project.deleted

Meetings

job.completed
job.failed

Team

member.invited
member.joined
member.removed
member.role_changed

Every request includes an X-Briefant-Signature header -- verify it against your endpoint's signing secret before trusting the payload:

Example delivery

POST https://your-endpoint.example.com/webhooks/briefant
X-Briefant-Signature: sha256=<hex-encoded HMAC-SHA256 of the raw body>
Content-Type: application/json

{
  "event": "job.completed",
  "org_id": "...",
  "data": { "job_id": "...", "project_id": "..." },
  "created_at": "2026-09-14T12:00:00Z"
}

Ready to build?

Create an API key or register an OAuth application from your workspace Settings once you've signed up.

Start free Read security details