---
title: "Minimal API"
description: "The Minimal REST API: 4 operations across 2 areas, with authentication, base URL and the error shape."
url: "https://support.outpostplatform.com/api/generated/minimal/"
product: "platform"
type: "reference"
status: "reviewed"
last_reviewed: 2026-09-13
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/api/generated/minimal/index.md"
license: "CC BY 4.0"
---

# Minimal API

The Minimal REST API has 4 operations, grouped here by area. Every page is generated from the route table itself, so what is documented is what is mounted.

## At a glance

| | |
| --- | --- |
| Version | `0.0.0-fixture` |
| Base URL | `https://{depotHost}` |
| Operations | 4 |
| Areas | 2 |
| Not fully resolved | 1 |

The base URL takes a variable:

| Variable | Default | What it is |
| --- | --- | --- |
| `depotHost` | `depot.example.com` | The hostname of the Depot being called. |

## Authentication

| Scheme | Sent as | What it is |
| --- | --- | --- |
| `consoleSession` | cookie `outpost_console` | The console session cookie, set when a person signs in. |
| `csrfToken` | header `X-Csrf-Token` | The double submit token that goes with the console session. |
| `provisionToken` | `Authorization: Bearer ...` | A provisioning token, for automation rather than a person. |

See [Authentication](/api/authentication/) for how each one is obtained.

## Areas

| Area | Operations | What it covers |
| --- | --- | --- |
| [Events](/api/generated/minimal/events/) | 2 | Public event streams and inbound hooks. |
| [Widgets](/api/generated/minimal/widgets/) | 2 | Widgets, the example resource. |

## When a request is refused

Every refusal has the same body, sent as `application/problem+json`. It is documented here once rather than on all 4 operations.

| Field | Type | Description |
| --- | --- | --- |
| `type` | string (uri) | A URI naming the problem. |
| `title` | string | A short summary of the problem. |
| `status` | integer | The HTTP status code. |
| `detail` | string | What went wrong on this request. |
| `errors` | object | Field errors, keyed by field name. |

## What this reference does not know {#unresolved}

1 of the 4 operations carry a note about something the extractor could not read from the source, such as a response type built inside a helper. Each one says so on its own operation. Everything else came straight from the route table.