> ## Documentation Index
> Fetch the complete documentation index at: https://help.gowindmill.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API overview

> Authenticate with an API key and call Windmill's public REST API to pull your team's data into your own systems.

Windmill's public API lets you read your company's data programmatically—so you can sync finalized review data into an HRIS, a data warehouse, or your own analytics. It's a standard REST API that returns JSON, and every route is scoped to a single company.

<Note>
  The API is read-focused and respects the same permissions and visibility rules as the Windmill Dashboard. An API key can only ever see what the person who created it can see.
</Note>

## Base URL

Every endpoint is scoped to your company and lives under this base path:

```
https://api.gowindmill.com/api/v2/c/{companySlug}
```

Your company slug is the identifier in your Dashboard URL—`https://app.gowindmill.com/{companySlug}/home`.

## Authentication

The API authenticates with **API keys**. Send your key in the `Authorization` header using the `Bearer` scheme:

```bash theme={null}
Authorization: Bearer wm_api_xxxxxxxxxxxxxxxxxxxx
```

Every Windmill API key starts with the `wm_api_` prefix.

### Creating an API key

<Steps>
  <Step title="Open API key settings">
    In the Windmill Dashboard, go to [**Settings → API keys**](https://app.gowindmill.com/COMPANY/config/api-keys).
  </Step>

  <Step title="Create a key">
    Click **Create API key**, give it a descriptive name, and optionally set an expiration date.
  </Step>

  <Step title="Copy it once">
    Copy the key and store it somewhere secure—Windmill shows the full key **only once** and you can't retrieve it again. If you lose it, revoke it and create a new one.
  </Step>
</Steps>

<Warning>
  An API key **inherits the permissions of the member who created it**. For endpoints that require a specific role—such as being a [cycle admin](/features/performance-reviews/visibility)—the person who created the key must hold that role. Treat keys like passwords and revoke any that are no longer needed.
</Warning>

## Requests and responses

* Request and response bodies are JSON. Send `Content-Type: application/json` on any request with a body.
* Timestamps are ISO 8601 strings (for example `2026-03-31T17:00:00.000Z`).
* Responses include only the fields documented for each endpoint—undeclared fields are stripped, so it's safe to build on the exact shape you see in the reference.

## Errors

Errors use standard HTTP status codes. Common ones across the API:

| Status             | Meaning                                                                                                      |
| ------------------ | ------------------------------------------------------------------------------------------------------------ |
| `400 Bad Request`  | The request body or parameters didn't match the expected schema.                                             |
| `401 Unauthorized` | The API key is missing, malformed, expired, or revoked.                                                      |
| `403 Forbidden`    | The key is valid but the member lacks the role required for this resource.                                   |
| `404 Not Found`    | The resource doesn't exist, or isn't in your company.                                                        |
| `409 Conflict`     | The resource isn't in a state that allows this action (for example, exporting a cycle that hasn't finished). |