HarkendocsOpen the app

API

Create a personal token, read your workspace from scripts, and understand scopes, approvals and rate limits.

The Harken API lets your own scripts and tools read your workspace: posts, leads, agents and numbers. It uses personal tokens, so there is no app to register and nothing to sign in with.

Creating a token

  1. Go to Settings, pick MCP / API, then switch to API.
  2. Press New token, name it after the tool that will use it, and tick the scopes it needs.
  3. Pick when it expires: in 30, 90 or 365 days, or never.
  4. Copy the token from the next screen. It starts with hk_pat_ and is shown only once.

A token acts as you, inside your workspace, and only within the scopes you ticked. Harken keeps a fingerprint of it, never the token itself, so a lost one cannot be shown again: revoke it and make a new one. Revoke stops a token at once. Each person may hold up to 25 live tokens; owners and admins also see and revoke their teammates' tokens.

Calling the API

The API base URL is on the same tab. Send the token in the Authorization header, prefixed with Bearer:

curl -H "Authorization: Bearer hk_pat_..." https://api.example.com/api/v1/public/leads

Read routes cover the workspace, posts and one post, leads and one lead, agents and stats. Every answer has the same shape: the result under data, and under meta the capability that answered and a request id worth quoting if you contact support. A scope the token lacks answers 403 insufficient_scope; an id from another workspace answers 404.

Changes need approval

A token can ask to change a post's status, a lead's status, or for a reply draft. A change answers 202 with approval_required and a link, and the request waits in the approvals inbox until someone approves it, just like a request from a connected assistant (see MCP). If your team has switched that kind of change off under MCP permissions, the call answers 403 action_disabled.

What you do with the data is your responsibility

Harken only provides your workspace data through the API. Anything you do with it afterwards happens outside Harken, including sending messages, replies or comments with browser tools, AI agents or any other process. You are responsible for those actions, for following each network's terms and the law, and for any account limits or bans that result.

Rate limits

Each token may make 60 calls a minute, and the whole workspace 1,000 a day across the API and connected assistants. Every answer carries X-RateLimit-Limit and X-RateLimit-Remaining headers. Past a limit you get 429 rate_limited with a Retry-After header telling you how many seconds to wait. The daily count starts again at midnight UTC.