Your first request

From nothing to a response, with curl.

Four steps to go from nothing to reading and writing real workspace data from your terminal.

1. Get a key

In Nest, Workspace → API keys → Create key. Tick the scopes you will use and save the token: it is shown exactly once.

Only workspace owners and admins can create keys. See API keys.

2. Check that it works

The cheapest read in the suite is the workspace the key belongs to. It needs the nest:workspace:read scope:

curl -s https://nest.eel.software/api/public/v1/workspace \
  -H "Authorization: Bearer eel_sk_..."
{ "id": "…", "name": "Acme", "created_at": "2026-01-14T15:22:03.000Z" }

If that answers, the credential is fine and everything else is a question of scopes.

3. Read something real

The first twenty-five contacts, with wrap:contacts:read:

curl -s "https://wrap.eel.software/api/public/v1/contacts?limit=25" \
  -H "Authorization: Bearer eel_sk_..."

4. Write something

POSTs that create something require an Idempotency-Key header. Generate one key per operation:

curl -s -X POST https://wrap.eel.software/api/public/v1/contacts \
  -H "Authorization: Bearer eel_sk_..." \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"name":"Ana Restrepo","email":"ana@example.com"}'

Run the same command again without changing the idempotency key and you get the same response back, not a second contact. Change the body while keeping the key and you get a 409.

When something fails

What you see It is almost always
401 on a valid credential Lowercase bearer, or an extra space
403 A missing scope. The message names it
400 asking for Idempotency-Key A POST without that header
404 on something you know exists It is in another workspace, or the credential cannot see it
429 You went over the pace. Wait what Retry-After says

Where to go next