openapi: 3.0.0 info: version: 1.5.0 title: Coda Account Permissions API license: name: Coda Developer Terms url: https://coda.io/trust/developer description: "# Introduction\n\nThe Coda API is a RESTful API that lets you programmatically interact with Coda docs:\n\n * List and search Coda docs\n * Create new docs and copy existing ones\n * Share and publish docs\n * Discover pages, tables, formulas, and controls\n * Read, insert, upsert, update, and delete rows\n\nIf you plan to integrate Coda with an AI tool, you may also want to consider using the\n[Coda MCP server](https://coda.io/resources/guides/getting_started_with_coda_mcp). It's optimized for LLM usage\npatterns and often exposes more granular methods for accessing and modifying data.\n\n# Getting Started\n\nOur [Getting Started Guide](https://coda.io/@oleg/getting-started-guide-coda-api) helps you learn the\nbasic of working with the API and shows a few ways you can use it. Check it out, and learn how to:\n\n- Read data from Coda tables and write back to them\n- Build a one-way sync from one Coda doc to another\n- Automate reminders\n- Sync your Google Calendar to Coda\n\n# Changes to the API\n\nAs we update and release newer versions of the API, we reserve the right to remove\nolder APIs and functionality with a 3-month deprecation notice. We will post about such changes as well as announce\nnew features in the [Developers Central](https://community.coda.io/c/developers-central) section of our Community,\nand update the [API updates](https://coda.io/api-updates) doc.\n\n# Using the API\n\nCoda's REST API is designed to be straightforward to use. You can use the language and platform of your choice to\nmake requests. To get a feel for the API, you can also use a tool like [Postman](https://www.getpostman.com/) or\n[Insomnia](https://insomnia.rest/).\n\n## API Endpoint\n\nThis API uses a base path of `https://coda.io/apis/v1`.\n\n## Resource IDs and Links\n\nEach resource instance retrieved via the API has the following fields:\n\n - `id`: The resource's immutable ID, which can be used to refer to it within its context\n - `type`: The type of resource, useful for identifying it in a heterogenous collection of results\n - `href`: A fully qualified URI that can be used to refer to and get the latest details on the resource\n\nMost resources can be queried by their name or ID. We recommend sticking with IDs where possible, as names are\nfragile and prone to being changed by your doc's users.\n\n### List Endpoints\n\nEndpoints supporting listing of resources have the following fields:\n\n - `items`: An array containing the listed resources, limited by the `limit` or `pageToken` query parameters\n - `nextPageLink`: If more results are available, an API link to the next page of results\n - `nextPageToken`: If more results are available, a page token that can be passed into the `pageToken` query parameter\n\n**The maximum page size may change at any time, and may be different for different endpoints.** Please do not rely on it\nfor any behavior of your application. If you pass a `limit` parameter that is larger than our maximum allowed limit,\nwe will only return as many results as our maximum limit. You should look for the presence of the `nextPageToken` on the\nresponse to see if there are more results available, rather than relying on a result set that matches your provided limit.\n\nTo fetch a subsequent page of results, pass the `pageToken` parameter. Set this parameter to the value given to you as the `nextPageToken`\nin a page response. If no value is provided, there are no more results available. You only need to pass the `pageToken` to get\nthe next page of results, you don't need to pass any of the parameters from your original request, as they are all\nimplied by the `pageToken`. Any other parameters provided alongside a `pageToken` will be ignored.\n\n### Doc IDs\n\nWhile most object IDs will have to be discovered via the API, you may find yourself frequently wanting to get the\nID of a specific Coda doc.\n\nHere's a handy tool that will extract it for you. (See if you can find the pattern!)\n\n
\n
\n Doc ID Extractor\n \n \n Your doc ID is:   \n \n
\n
\n\n## Rate Limiting\n\nThe Coda API sets a reasonable limit on the number of requests that can be made per minute. Once this limit is\nreached, calls to the API will start returning errors with an HTTP status code of 429.\n\nThese are the current rate limits. They are subject to change at any time without notice. For robustness,\nall API scripts should check for HTTP 429 Too Many Requests errors and back off and retry the request.\nLimits apply per-user across all endpoints that share the same limit and across all docs.\n\nReading data (with the exceptions below): {{READ_RATE_LIMIT}}\n
\nWriting data (POST/PUT/PATCH): {{WRITE_RATE_LIMIT}}\n
\nWriting doc content data (POST/PUT/PATCH): {{WRITE_DOC_CONTENT_RATE_LIMIT}}\n
\nListing docs: {{LIST_DOCS_RATE_LIMIT}}\n
\nReading analytics: {{ANALYTICS_RATE_LIMIT}}\n\n## Consistency\n\nWhile edits made in Coda are shared with other collaborators in real-time, it can take a few seconds for them to\nbecome available via the API. You may also notice that changes made via the API, such as updating a row, are not\nimmediate. These endpoints all return an HTTP 202 status code, instead of a standard 200, indicating that the\nedit has been accepted and queued for processing. This generally takes a few seconds, and the edit may fail if\ninvalid. Each such edit will return a `requestId` in the response, and you can pass this `requestId` to the\n[`#getMutationStatus`](#operation/getMutationStatus) endpoint to find out if it has been applied.\n\nSimilarly, when you get doc data from the API (rows, pages, columns, etc), the data you receive comes from\nthe most recent \"snapshot\" of the doc, which might be slightly stale relative to the data you observe in\nyour browser. If you want to ensure that the data you receive is up to date and are ok getting an error if not,\nyou can pass this header in your request: `X-Coda-Doc-Version: latest`. If the API's view of the doc is\nnot up to date, the API will return an HTTP 400 response.\n\n## Volatile Formulas\n\nCoda exposes a number of \"volatile\" formulas, as as `Today()`, `Now()`, and `User()`. When used in a live Coda\ndoc, these formulas affect what's visible in realtime, tailored to the current user.\n\nSuch formulas behave differently with the API. Time-based values may only be current to the last edit made to the\ndoc. User-based values may be blank or invalid.\n\n## Free and Paid Workspaces\n\nWe make the Coda API available to all of our users free of charge, in both free and paid workspaces. However, API\nusage is subject to the role of the user associated with the API token in the workspace applicable to each API\nrequest. What this means is:\n\n- For the [`#createDoc`](#operation/createDoc) endpoint specifically, the owner of the API token must be a Doc\n Maker (or Admin) in the workspace. If the \"Any member can create docs\" option in enabled in the workspace\n settings, they can be an Editor and will get auto-promoted to Doc Maker upon using this endpoint. Lastly, if in\n addition, the API key owner matches the \"Auto-join email domains\" setting, they will be auto-added to the\n workspace and promoted to Doc Maker upon using this endpoint\n\nThis behavior applies to the API as well as any integrations that may use it, such as Zapier.\n\n## Examples\n\nTo help you get started, this documentation provides code examples in Python, Unix shell, and Google Apps Script.\nThese examples are based on a simple doc that looks something like this:\n\n![](https://cdn.coda.io/external/img/api_example_doc.png)\n\n### Python examples\n\nThese examples use Python 3.6+. If you don't already have the `requests` module, use `pip` or `easy_install` to\nget it.\n\n### Shell examples\n\nThe shell examples are intended to be run in a Unix shell. If you're on Windows, you will need to install\n[WSL](https://docs.microsoft.com/en-us/windows/wsl/install-win10).\n\nThese examples use the standard cURL utility to pull from the API, and then process it with `jq` to extract and\nformat example output. If you don't already have it, you can either [install it](https://stedolan.github.io/jq/)\nor run the command without it to see the raw JSON output.\n\n### Google Apps Script examples\n\n![](https://cdn.coda.io/external/img/api_gas.png)\n\n[Google Apps Script](https://script.google.com/) makes it easy to write code in a JavaScript-like syntax and\neasily access many Google products with built-in libraries. You can set up your scripts to run periodically,\nwhich makes it a good environment for writing tools without maintaining your own server.\n\nCoda provides a library for Google Apps Script. To use it, go into `Resources -> Libraries...` and enter the\nfollowing library ID: `15IQuWOk8MqT50FDWomh57UqWGH23gjsWVWYFms3ton6L-UHmefYHS9Vl`. If you want to see the\nlibrary's source code, it's available\n[here](https://script.google.com/d/15IQuWOk8MqT50FDWomh57UqWGH23gjsWVWYFms3ton6L-UHmefYHS9Vl/edit).\n\nGoogle provides autocomplete for API functions as well as generated docs. You can access these docs via the\nLibraries dialog by clicking on the library name. Required parameters that would be included in the URL path are\npositional arguments in each of these functions, followed by the request body, if applicable. All remaining\nparameters can be specified in the options object.\n\n## OpenAPI/Swagger Spec\n\nIn an effort to standardize our API and make it accessible, we offer an OpenAPI 3.0 specification:\n\n- [OpenAPI 3.0 spec - YAML](https://coda.io/apis/v1/openapi.yaml)\n- [OpenAPI 3.0 spec - JSON](https://coda.io/apis/v1/openapi.json)\n\n#### Postman collection\n\nTo get started with prototyping the API quickly in Postman, you can use one of links above to import the Coda API\ninto a collection. You'll then need to set the [appropriate header](#section/Authentication) and environment\nvariables.\n\n## Client libraries\n\nWe do not currently support client libraries apart from Google Apps Script. To work with the Coda API, you can\neither use standard network libraries for your language, or use the appropriate Swagger Generator tool to\nauto-generate Coda API client libraries for your language of choice. We do not provide any guarantees that these\nautogenerated libraries are compatible with our API (e.g., some libraries may not work with Bearer\nauthentication).\n\n### OpenAPI 3.0\n\n[Swagger Generator 3](https://generator3.swagger.io/) (that link takes you to the docs for the generator API) can\ngenerate client libraries for [these languages](https://generator3.swagger.io/v2/clients). It's relatively new\nand thus only has support for a limited set of languages at this time.\n\n### Third-party client libraries\n\nSome members of our amazing community have written libraries to work with our API. These aren't officially\nsupported by Coda, but are listed here for convenience. (Please let us know if you've written a library and would\nlike to have it included here.)\n\n- [PHP](https://github.com/danielstieber/CodaPHP) by Daniel Stieber\n- [Node-RED](https://github.com/serene-water/node-red-contrib-coda-io) by Mori Sugimoto\n- [NodeJS](https://www.npmjs.com/package/coda-js) by Parker McMullin\n- [Ruby](https://rubygems.org/gems/coda_docs/) by Carlos Muñoz at Getro\n- [Python](https://github.com/Blasterai/codaio) by Mikhail Beliansky\n- [Go](https://github.com/artsafin/coda-schema-generator) by Artur Safin\n" termsOfService: https://coda.io/trust/tos contact: name: API Support url: https://coda.io email: help+api@coda.io x-logo: url: https://cdn.coda.io/external/img/apilogo.png backgroundColor: transparent altText: Coda API href: '#' servers: - url: https://coda.io/apis/v1 description: Coda API (v1) security: - Bearer: [] tags: - name: Permissions description: This API lets you manage sharing and permissions for your docs. paths: /docs/{docId}/acl/metadata: get: summary: Get sharing metadata description: Returns metadata associated with sharing for this Coda doc. operationId: getSharingMetadata tags: - Permissions parameters: - $ref: '#/components/parameters/docId' responses: '200': description: Metadata associated with sharing permissions for a doc. content: application/json: schema: $ref: '#/components/schemas/AclMetadata' '401': $ref: '#/components/responses/UnauthorizedError' '403': $ref: '#/components/responses/ForbiddenError' '404': $ref: '#/components/responses/NotFoundError' '429': $ref: '#/components/responses/TooManyRequestsError' x-codeSamples: - label: Python 3.13 lang: python source: 'import requests headers = {''Authorization'': ''Bearer ''} uri = f''https://coda.io/apis/v1/docs//acl/metadata'' res = requests.get(uri, headers=headers).json() print(f''Can I share this doc with others? {res["canShare"]}'') # => Can I share this doc with others? true ' - label: Shell lang: shell source: "curl -s -H 'Authorization: Bearer ' \\\n 'https://coda.io/apis/v1/docs//acl/metadata' |\n jq .canShare\n# => \"true\"\n" - label: Google Apps Script lang: javascript source: '// Import the CodaAPI library via Resource->Libraries...: // 15IQuWOk8MqT50FDWomh57UqWGH23gjsWVWYFms3ton6L-UHmefYHS9Vl CodaAPI.authenticate(''''); var docSharingMetadata = CodaAPI.getSharingMetadata(''''); Logger.log(''Can I share this doc with others? '' + docSharingMetadata.canShare); // => Can I share this doc with others? true ' /docs/{docId}/acl/permissions: get: summary: List permissions description: Returns a list of permissions for this Coda doc. operationId: getPermissions tags: - Permissions parameters: - $ref: '#/components/parameters/docId' - $ref: '#/components/parameters/limit' - $ref: '#/components/parameters/pageToken' responses: '200': description: List of permissions for a doc. content: application/json: schema: $ref: '#/components/schemas/Acl' '401': $ref: '#/components/responses/UnauthorizedError' '403': $ref: '#/components/responses/ForbiddenError' '404': $ref: '#/components/responses/NotFoundError' '429': $ref: '#/components/responses/TooManyRequestsError' x-codeSamples: - label: Python 3.13 lang: python source: 'import requests headers = {''Authorization'': ''Bearer ''} uri = f''https://coda.io/apis/v1/docs//acl/permissions'' res = requests.get(uri, headers=headers).json() print(f''First user with access is {res["items"][0]["principal"]["email"]}'') # => First user with access is foo@bar.com ' - label: Shell lang: shell source: "curl -s -H 'Authorization: Bearer ' \\\n 'https://coda.io/apis/v1/docs//acl/permissions' |\n jq '.items[].principal.email'\n# => \"foo@bar.com\", \"baz@bar.com\"\n" - label: Google Apps Script lang: javascript source: '// Import the CodaAPI library via Resource->Libraries...: // 15IQuWOk8MqT50FDWomh57UqWGH23gjsWVWYFms3ton6L-UHmefYHS9Vl CodaAPI.authenticate(''''); var docPermissions = CodaAPI.getPermissions(''''); Logger.log(''First user with access is '' + docPermissions[0].principal.email); // => First user with access is foo@bar.com ' post: summary: Add permission description: 'Adds a new permission to the doc. ' operationId: addPermission tags: - Permissions parameters: - $ref: '#/components/parameters/docId' requestBody: description: Parameters for adding the new permission. required: true content: application/json: schema: $ref: '#/components/schemas/AddPermissionRequest' responses: '200': description: Confirmation that the request was applied. content: application/json: schema: $ref: '#/components/schemas/AddPermissionResult' '400': $ref: '#/components/responses/BadRequestError' '401': $ref: '#/components/responses/UnauthorizedError' '403': $ref: '#/components/responses/ForbiddenError' '404': $ref: '#/components/responses/NotFoundError' '429': $ref: '#/components/responses/TooManyRequestsError' x-codeSamples: - label: Python 3.13 lang: python source: "import requests\n\nheaders = {'Authorization': 'Bearer '}\nuri = f'https://coda.io/apis/v1/docs//acl/permissions'\npayload = {\n 'access': 'write',\n 'principal': {\n 'type': 'email',\n 'email': 'foo@bar.com'\n },\n}\nres = requests.post(uri, headers=headers, json=payload)\n\n# => Grant 'foo@bar.com' write access to the doc and send a share notification email\n" - label: Shell lang: shell source: "curl -s -H 'Authorization: Bearer ' -X POST \\\n 'https://coda.io/apis/v1/docs//acl/permissions' \\\n -d '{\"access\": \"write\", \"principal\": {\"type\": \"email\", \"email\": \"foo@bar.com\"}}'\n# => Grant 'foo@bar.com' write access to the doc and send a share notification email\n" - label: Google Apps Script lang: javascript source: "// Import the CodaAPI library via Resource->Libraries...:\n// 15IQuWOk8MqT50FDWomh57UqWGH23gjsWVWYFms3ton6L-UHmefYHS9Vl\nCodaAPI.authenticate('');\nvar docPermissions = CodaAPI.addPermission(\n '',\n {access: 'write', principal: {type: 'email', email: 'foo@bar.com'}}\n);\n// => Grant 'foo@bar.com' write access to the doc and send a share notification email\n" /docs/{docId}/acl/permissions/{permissionId}: delete: summary: Delete permission description: 'Deletes an existing permission. ' operationId: deletePermission tags: - Permissions parameters: - $ref: '#/components/parameters/docId' - $ref: '#/components/parameters/permissionId' responses: '200': description: Confirmation that the request was applied. content: application/json: schema: $ref: '#/components/schemas/DeletePermissionResult' '400': $ref: '#/components/responses/BadRequestError' '401': $ref: '#/components/responses/UnauthorizedError' '403': $ref: '#/components/responses/ForbiddenError' '404': $ref: '#/components/responses/NotFoundError' '429': $ref: '#/components/responses/TooManyRequestsError' x-codeSamples: - label: Python 3.13 lang: python source: 'import requests headers = {''Authorization'': ''Bearer ''} uri = f''https://coda.io/apis/v1/docs//acl/permissions/'' res = requests.delete(uri, headers=headers, json=payload) # => Revoke access to the doc ' - label: Shell lang: shell source: "curl -s -H 'Authorization: Bearer ' -X DELETE \\\n 'https://coda.io/apis/v1/docs//acl/permissions/'\n# => Revoke access to the doc\n" - label: Google Apps Script lang: javascript source: '// Import the CodaAPI library via Resource->Libraries...: // 15IQuWOk8MqT50FDWomh57UqWGH23gjsWVWYFms3ton6L-UHmefYHS9Vl CodaAPI.authenticate(''''); var docPermissions = CodaAPI.deletePermission('''', ''''); // => Revoke access to the doc ' /docs/{docId}/acl/principals/search: get: summary: Search principals description: 'Searches for user and group principals matching the query that this doc can be shared with. At most 20 results will be returned for both users and groups. If no query is given then no results are returned. ' operationId: searchPrincipals tags: - Permissions parameters: - $ref: '#/components/parameters/docId' - $ref: '#/components/parameters/query' responses: '200': description: Search results for the given query. content: application/json: schema: $ref: '#/components/schemas/SearchPrincipalsResponse' '400': $ref: '#/components/responses/BadRequestError' '401': $ref: '#/components/responses/UnauthorizedError' '403': $ref: '#/components/responses/ForbiddenError' '404': $ref: '#/components/responses/NotFoundError' '429': $ref: '#/components/responses/TooManyRequestsError' x-codeSamples: - label: Python 3.13 lang: python source: 'import requests headers = {''Authorization'': ''Bearer ''} uri = f''https://coda.io/apis/v1/docs//acl/principals/search?search=foo'' res = requests.get(uri, headers=headers).json() print(f''First user with access is {res["users"][0]["email"]}'') # => First user with access is foo@bar.com ' - label: Shell lang: shell source: "curl -s -H 'Authorization: Bearer ' \\\n 'https://coda.io/apis/v1/docs//acl/permissions/search?search=foo' |\n jq '.users[].email'\n# => \"foo@bar.com\", \"baz@bar.com\"\n" - label: Google Apps Script lang: javascript source: '// Import the CodaAPI library via Resource->Libraries...: // 15IQuWOk8MqT50FDWomh57UqWGH23gjsWVWYFms3ton6L-UHmefYHS9Vl CodaAPI.authenticate(''''); var principals = CodaAPI.searchPrincipals(''''); Logger.log(''First user with access is '' + docPermissions[0].principal.email); // => First user with access is foo@bar.com ' /docs/{docId}/acl/settings: get: summary: Get ACL settings description: Returns settings associated with ACLs for this Coda doc. operationId: getAclSettings tags: - Permissions parameters: - $ref: '#/components/parameters/docId' responses: '200': description: Settings associated with access control for a doc. content: application/json: schema: $ref: '#/components/schemas/AclSettings' '401': $ref: '#/components/responses/UnauthorizedError' '403': $ref: '#/components/responses/ForbiddenError' '404': $ref: '#/components/responses/NotFoundError' '429': $ref: '#/components/responses/TooManyRequestsError' x-codeSamples: - label: Python 3.13 lang: python source: 'import requests headers = {''Authorization'': ''Bearer ''} uri = f''https://coda.io/apis/v1/docs//acl/settings'' res = requests.get(uri, headers=headers).json() print(f''Can editors change sharing permissions? {res["allowEditorsToChangePermissions"]}'') # => Can editors change sharing permissions? false ' - label: Shell lang: shell source: "curl -s -H 'Authorization: Bearer ' \\\n 'https://coda.io/apis/v1/docs//acl/settings' |\n jq .allowEditorsToChangePermissions\n# => \"false\"\n" - label: Google Apps Script lang: javascript source: '// Import the CodaAPI library via Resource->Libraries...: // 15IQuWOk8MqT50FDWomh57UqWGH23gjsWVWYFms3ton6L-UHmefYHS9Vl CodaAPI.authenticate(''''); var settings = CodaAPI.getAclSettings(''''); Logger.log(''Can editors change sharing permissions? '' + settings.allowEditorsToChangePermissions); // => Can editors change sharing permissions? true ' patch: summary: Update ACL settings description: Update settings associated with ACLs for this Coda doc. operationId: updateAclSettings tags: - Permissions parameters: - $ref: '#/components/parameters/docId' requestBody: description: Parameters for updating the ACL settings. required: true content: application/json: schema: $ref: '#/components/schemas/UpdateAclSettingsRequest' responses: '200': description: Settings associated with access control for a doc. content: application/json: schema: $ref: '#/components/schemas/AclSettings' '401': $ref: '#/components/responses/UnauthorizedError' '403': $ref: '#/components/responses/ForbiddenError' '404': $ref: '#/components/responses/NotFoundError' '429': $ref: '#/components/responses/TooManyRequestsError' components: schemas: AddPermissionRequest: x-schema-name: AddPermissionRequest description: Payload for granting a new permission. type: object required: - access - principal additionalProperties: false properties: access: $ref: '#/components/schemas/AccessTypeNotNone' principal: $ref: '#/components/schemas/AddedPrincipal' suppressEmail: type: boolean description: When true suppresses email notification AddedDomainPrincipal: type: object required: - domain - type additionalProperties: false properties: type: type: string description: The type of this principal. enum: - domain x-tsType: PrincipalType.Domain domain: type: string description: Domain for the principal. example: domain.com AccessType: x-schema-name: AccessType description: Type of access. type: string enum: - readonly - write - comment - none x-tsEnumNames: - ReadOnly - Write - Comment - None UpdateAclSettingsRequest: x-schema-name: UpdateAclSettingsRequest description: Request to update ACL settings for a doc. type: object additionalProperties: false properties: allowEditorsToChangePermissions: type: boolean description: 'When true, allows editors to change doc permissions. When false, only doc owner can change doc permissions. ' allowCopying: type: boolean description: When true, allows doc viewers to copy the doc. allowViewersToRequestEditing: type: boolean description: When true, allows doc viewers to request editing permissions. EmailPrincipal: type: object required: - email - type additionalProperties: false properties: type: type: string description: The type of this principal. enum: - email x-tsType: PrincipalType.Email email: type: string description: Email for the principal. example: example@domain.com AddedPrincipal: x-schema-name: AddedPrincipal description: Metadata about a principal to add to a doc. oneOf: - $ref: '#/components/schemas/AddedEmailPrincipal' - $ref: '#/components/schemas/AddedGroupPrincipal' - $ref: '#/components/schemas/AddedDomainPrincipal' - $ref: '#/components/schemas/AddedWorkspacePrincipal' - $ref: '#/components/schemas/AddedAnyonePrincipal' discriminator: propertyName: type mapping: email: '#/components/schemas/AddedEmailPrincipal' group: '#/components/schemas/AddedGroupPrincipal' domain: '#/components/schemas/AddedDomainPrincipal' workspace: '#/components/schemas/AddedWorkspacePrincipal' anyone: '#/components/schemas/AddedAnyonePrincipal' AddedWorkspacePrincipal: type: object required: - type - workspaceId additionalProperties: false properties: type: type: string description: The type of this principal. enum: - workspace x-tsType: PrincipalType.Workspace workspaceId: type: string description: WorkspaceId for the principal. example: ws-sdfmsdf9 DomainPrincipal: type: object required: - domain - type additionalProperties: false properties: type: type: string description: The type of this principal. enum: - domain x-tsType: PrincipalType.Domain domain: type: string description: Domain for the principal. example: domain.com InternalAccessPrincipal: type: object required: - type - internalAccessType additionalProperties: false properties: type: type: string description: The type of this principal. enum: - internalAccess x-tsType: PrincipalType.InternalAccess internalAccessType: type: string description: The type of internal access (e.g., support). example: support WorkspacePrincipal: type: object required: - type - workspaceId additionalProperties: false properties: type: type: string description: The type of this principal. enum: - workspace x-tsType: PrincipalType.Workspace workspaceId: type: string description: WorkspaceId for the principal. example: ws-sdfmsdf9 AccessTypeNotNone: x-schema-name: AccessTypeNotNone description: Type of access (excluding none). type: string enum: - readonly - write - comment x-tsEnumNames: - ReadOnly - Write - Comment Acl: x-schema-name: Acl description: List of Permissions. type: object required: - items - href additionalProperties: false properties: items: type: array items: $ref: '#/components/schemas/Permission' href: type: string format: url description: API link to these results example: https://coda.io/apis/v1/docs/AbCDeFGH/acl?limit=20 nextPageToken: $ref: '#/components/schemas/nextPageToken' nextPageLink: allOf: - $ref: '#/components/schemas/nextPageLink' - type: string example: https://coda.io/apis/v1/docs/AbCDeFGH/acl?pageToken=eyJsaW1pd nextPageToken: description: If specified, an opaque token used to fetch the next page of results. type: string example: eyJsaW1pd AclSettings: x-schema-name: AclSettings description: Sharing settings for the doc. type: object required: - allowEditorsToChangePermissions - allowCopying - allowViewersToRequestEditing additionalProperties: false properties: allowEditorsToChangePermissions: type: boolean description: 'When true, allows editors to change doc permissions. When false, only doc owner can change doc permissions. ' allowCopying: type: boolean description: When true, allows doc viewers to copy the doc. allowViewersToRequestEditing: type: boolean description: When true, allows doc viewers to request editing permissions. AddPermissionResult: x-schema-name: AddPermissionResult description: The result of sharing a doc. type: object additionalProperties: false properties: {} AnyonePrincipal: type: object required: - type additionalProperties: false properties: type: type: string description: The type of this principal. enum: - anyone x-tsType: PrincipalType.Anyone Permission: x-schema-name: Permission description: A specific permission granted to a principal. type: object required: - principal - id - access additionalProperties: false properties: principal: $ref: '#/components/schemas/Principal' id: type: string description: Id for the Permission access: $ref: '#/components/schemas/AccessType' UserSummary: x-schema-name: UserSummary description: Summary about the user. type: object required: - name - loginId - type additionalProperties: false properties: name: type: string description: Name of the user. example: John Doe loginId: type: string description: Email address of the user. example: user@example.com type: type: string description: The type of this resource. enum: - user x-tsType: Type.User pictureLink: type: string format: url description: Browser-friendly link to the user's avatar image. example: https://cdn.coda.io/avatars/default_avatar.png Principal: x-schema-name: Principal description: Metadata about a principal. oneOf: - $ref: '#/components/schemas/EmailPrincipal' - $ref: '#/components/schemas/GroupPrincipal' - $ref: '#/components/schemas/DomainPrincipal' - $ref: '#/components/schemas/WorkspacePrincipal' - $ref: '#/components/schemas/AnyonePrincipal' - $ref: '#/components/schemas/InternalAccessPrincipal' discriminator: propertyName: type mapping: email: '#/components/schemas/EmailPrincipal' group: '#/components/schemas/GroupPrincipal' domain: '#/components/schemas/DomainPrincipal' workspace: '#/components/schemas/WorkspacePrincipal' anyone: '#/components/schemas/AnyonePrincipal' internalAccess: '#/components/schemas/InternalAccessPrincipal' AddedAnyonePrincipal: type: object required: - type additionalProperties: false properties: type: type: string description: The type of this principal. enum: - anyone x-tsType: PrincipalType.Anyone SearchPrincipalsResponse: x-schema-name: SearchPrincipalsResponse description: Metadata about the principals that match the given query. type: object required: - users - groups additionalProperties: false properties: users: type: array items: $ref: '#/components/schemas/UserSummary' groups: type: array items: $ref: '#/components/schemas/GroupPrincipal' AclMetadata: x-schema-name: Acl description: Doc level metadata associated with ACL. type: object required: - canShare - canShareWithWorkspace - canShareWithOrg - canCopy additionalProperties: false properties: canShare: type: boolean description: When true, the user of the api can share canShareWithWorkspace: type: boolean description: When true, the user of the api can share with the workspace canShareWithOrg: type: boolean description: When true, the user of the api can share with the org canCopy: type: boolean description: When true, the user of the api can copy the doc GroupPrincipal: type: object required: - groupId - groupName - type additionalProperties: false properties: type: type: string description: The type of this principal. enum: - group x-tsType: PrincipalType.Group groupId: type: string description: Group ID for the principal. example: grp-6SM9xrKcqW groupName: type: string description: Name of the group. example: Marketing team AddedGroupPrincipal: type: object required: - groupId - type additionalProperties: false properties: type: type: string description: The type of this principal. enum: - group x-tsType: PrincipalType.Group groupId: type: string description: Group ID for the principal. example: grp-6SM9xrKcqW nextPageLink: description: If specified, a link that can be used to fetch the next page of results. type: string format: url AddedEmailPrincipal: type: object required: - email - type additionalProperties: false properties: type: type: string description: The type of this principal. enum: - email x-tsType: PrincipalType.Email email: type: string description: Email for the principal. example: example@domain.com DeletePermissionResult: x-schema-name: DeletePermissionResult description: The result of deleting a permission. type: object additionalProperties: false properties: {} responses: BadRequestError: description: The request parameters did not conform to expectations. content: application/json: schema: description: An HTTP error resulting from an unsuccessful request. required: - statusCode - statusMessage - message additionalProperties: false properties: statusCode: type: number description: HTTP status code of the error. example: 400 statusMessage: type: string description: HTTP status message of the error. example: Bad Request message: type: string description: Any additional context on the error, or the same as `statusMessage` otherwise. example: Bad Request NotFoundError: description: The resource could not be located with the current API token. content: application/json: schema: description: An HTTP error resulting from an unsuccessful request. required: - statusCode - statusMessage - message additionalProperties: false properties: statusCode: type: number description: HTTP status code of the error. example: 404 statusMessage: type: string description: HTTP status message of the error. example: Not Found message: type: string description: Any additional context on the error, or the same as `statusMessage` otherwise. example: Not Found ForbiddenError: description: The API token does not grant access to this resource. content: application/json: schema: description: An HTTP error resulting from an unsuccessful request. required: - statusCode - statusMessage - message additionalProperties: false properties: statusCode: type: number description: HTTP status code of the error. example: 403 statusMessage: type: string description: HTTP status message of the error. example: Forbidden message: type: string description: Any additional context on the error, or the same as `statusMessage` otherwise. example: Forbidden TooManyRequestsError: description: The client has sent too many requests. content: application/json: schema: description: An HTTP error resulting from an unsuccessful request. required: - statusCode - statusMessage - message additionalProperties: false properties: statusCode: type: number description: HTTP status code of the error. example: 429 statusMessage: type: string description: HTTP status message of the error. example: Too Many Requests message: type: string description: Any additional context on the error, or the same as `statusMessage` otherwise. example: Too Many Requests UnauthorizedError: description: The API token is invalid or has expired. content: application/json: schema: description: An HTTP error resulting from an unsuccessful request. required: - statusCode - statusMessage - message additionalProperties: false properties: statusCode: type: number description: HTTP status code of the error. example: 401 statusMessage: type: string description: HTTP status message of the error. example: Unauthorized message: type: string description: Any additional context on the error, or the same as `statusMessage` otherwise. example: Unauthorized parameters: docId: name: docId description: ID of the doc. in: path required: true example: AbCDeFGH schema: type: string limit: name: limit description: Maximum number of results to return in this query. in: query example: 10 schema: type: integer minimum: 1 default: 25 query: name: query description: Search term used to filter down results. in: query example: Supercalifragilisticexpialidocious schema: type: string permissionId: name: permissionId description: ID of a permission on a doc. in: path required: true example: AbCDeFGH schema: type: string pageToken: name: pageToken description: An opaque token used to fetch the next page of results. in: query example: eyJsaW1pd schema: type: string securitySchemes: Bearer: description: "The Coda API can be accessed using an API token, which can be obtained from [*My account*](https://coda.io/account)\nin Coda. This token should be specified by setting a header as follows.\n\n```Authorization: Bearer ```\n\nKeep your token safe, as anyone who gets access to it can access your account. Once a token is created\nit cannot be viewed or modified, so don't lose it.\n\nIf you're logged into Coda, you can also query the API directly using your browser. Note that only GET\nendpoints are supported; for anything else, you'll have to use Bearer authentication.\n\n### Restricting token authorization\n\nBy default, bearer tokens created for the Coda API can perform any action that the user who created the token\ncan perform. However, Coda API bearer tokens can also be created with restrictions. These restrictions\ncan limit what objects can be operated on and the types of operations that can be performed.\n\n#### Operation types\n\nThe table below describes the types of authorization restrictions that can be placed on a Coda API token.\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
RestrictionDescriptionAllowed HTTP Methods
Read accessAllows access to API methods that read the state of an objectGET
Write accessAllows access to API methods that write the state of an objectPOST, PUT, DELETE
Read and write accessAllows access to all methods for an objectAll
\n\n#### Object types\n\nCoda API tokens can be restricted to the following types of objects.\n\n* Documents: Restricts access to only allow API calls for `/docs/${DOC_ID}`\n* Tables: Restricts access to only allow API calls for `/docs/${DOC_ID}/tables/${TABLE_ID}`\n\n#### Special cases\n\nThere are a few special case methods that violate the above restrictions.\n\n* `/whoami`: This method can be called by all Coda API tokens.\n* `/resolveBrowserLink`: This method can be called by all Coda API tokens, but will only return a result\nif the token has access (read or write) to the object referenced by the URL.\n\n#### Feedback\n\nThis feature is under development and we'd love to hear your feedback and bug reports. Please\nvisit us at the [Developers Central](https://connect.superhuman.com/c/developers-central) forum within\nthe Coda Community.\n" type: http scheme: bearer bearerFormat: UUID x-tagGroups: - name: Folders tags: - Folders - name: Docs tags: - Docs - Permissions - Publishing - name: Doc Structure tags: - Pages - Automations - name: Tables and Views tags: - Tables - Columns - Rows - name: Formulas & Controls tags: - Formulas - Controls - name: Miscellaneous tags: - Account - Analytics - Miscellaneous