---
key: api-overview
title: Nova API overview
audience: developer
section: api/getting-started
routes: []
since: 0.0.1
updated: 0.0.1
status: published
summary: What the Nova API covers, the three ways software connects, how records are addressed, and where to start as an integration or an AI agent.
keywords: [api, integration, agent, mcp, openapi, developer]
related: [api-authentication, find-what-to-call, connect-an-ai-agent, api-conventions, api-errors, api-webhooks]
---

Software can do anything in Nova that the organization lets it: customers
and contacts, quotes, invoices, payments, work orders, the Schedule, tasks,
projects, bookings, tickets, notes, files, agreements, bookkeeping and more.
About 80 common operations are documented in full in the
[[api-reference|API reference]]; every other operation (roughly 3,200 in all)
is listed in the operation index with the permission it needs:
[[find-what-to-call]]. Both are generated from the running code for every
release, so they never drift from what the app does.

## Three ways in, one API

- **API key** — your own software in your own organization. See
  [[make-your-first-api-request]].
- **Connected app** — OAuth 2.1; acts as the person who connected it. This is
  how ChatGPT, Claude and other assistants act for a person. See
  [[api-authentication]] and [[connect-an-ai-agent]].
- **AI teammate** — an AI with its own name and roles in one organization.
  See [[run-an-ai-teammate]].

[[choose-an-api-key-or-a-connected-app]] helps you pick. All three call the
same routes the Nova app uses, so every permission check, validation rule and
audit event applies exactly as it does in the app.

## Records and identity

- Every record you can address has an opaque `uid` such as `acct_a1b2c3d4e5f6a1b2`.
  Integer ids never appear on the wire. Use the uid in paths and bodies.
  See [[api-record-identity]].
- People read record numbers such as `ACC-000001`; search by them, but link
  by uid.
- Every token is bound to one organization. Send `X-Organization-ID` only when
  you hold a browser session token; machine credentials already carry it.

## What a credential may do

Whatever the organization grants it, and never more than the person who set
it up can do themselves. Nothing an organization can do is held back from its
own software. An organization can also ask for a person to approve particular
actions each time, and the few actions Nova guards with an identity check
(payout accounts, role changes, bulk exports) always wait for a person when
software tries them ([[wait-for-a-person-to-approve]]). Limits sit beside the
grant: rate, a daily cap, addresses, branches, expiry ([[api-limits]]).

Signing in, the OAuth endpoints, platform administration and the routes that
manage credentials are never open to software.

## Where to go next

1. [[api-authentication]] to get a token.
2. [[api-conventions]] and [[api-errors]] for paging, errors and retries.
3. [[api-reference]] for the documented operations, [[find-what-to-call]] for
   everything else.
4. [[api-webhooks]] to be told when something changes instead of polling.