API documentation — Atrict

Overview

Atrict exposes a JSON API for kids, memories, photos, families, permissions, and invites. Authenticate with an OAuth bearer token issued by the token endpoint, then call the API directly or experiment with it in the in-browser Swagger UI.

Getting credentials

1. Open Settings → API access.
2. Click "Create API client", name it, pick scopes, confirm with step-up.
3. Copy the client ID and client secret once — we don't store the plaintext.

OAuth flow

Atrict supports the client_credentials grant for machine-to-machine access. Exchange your client_id + client_secret at /api/oauth/token to receive a short-lived JWT bearer token (default TTL: 15 minutes). Send the token in the Authorization header on every API request.

Calling the API

# exchange credentials
curl -s -u "$ATRICT_CLIENT_ID:$ATRICT_CLIENT_SECRET" \
  https://atrict.com/api/oauth/token \
  -d "grant_type=client_credentials" \
  -d "scope=common:read"

# list kids
curl https://atrict.com/api/kids \
  -H "Authorization: Bearer $TOKEN"

const creds = btoa(`${process.env.ATRICT_CLIENT_ID}:${process.env.ATRICT_CLIENT_SECRET}`);
const tokRes = await fetch("https://atrict.com/api/oauth/token", {
  method: "POST",
  headers: { "Authorization": `Basic ${creds}`, "Content-Type": "application/x-www-form-urlencoded" },
  body: "grant_type=client_credentials&scope=common:read",
});
const { access_token } = await tokRes.json();

const res = await fetch("https://atrict.com/api/kids", {
  headers: { "Authorization": `Bearer ${access_token}` },
});
console.log(await res.json());

import os, httpx

auth = (os.environ["ATRICT_CLIENT_ID"], os.environ["ATRICT_CLIENT_SECRET"])
tok = httpx.post("https://atrict.com/api/oauth/token", auth=auth,
                 data={"grant_type": "client_credentials", "scope": "common:read"}).json()

kids = httpx.get("https://atrict.com/api/kids",
                 headers={"Authorization": f"Bearer {tok['access_token']}"}).json()
print(kids)

Pagination

List endpoints return a PageResult<T> envelope — { items, nextCursor }. To fetch the next page, pass ?cursor=<nextCursor>. When nextCursor is null, you've reached the end. Cursors are opaque base64-encoded values; don't decode or generate them yourself.

Errors

Errors follow RFC 7807 (Problem Details). Common codes:

• 401 — missing or invalid Bearer token (re-exchange credentials)
• 403 — token's scopes don't cover the operation
• 404 — resource doesn't exist or caller has no access (intentionally indistinguishable to avoid leaking existence)
• 413 — request body too large (photo upload limits)
• 422 — validation failed; errors object lists per-field messages
• 429 — rate-limited; back off and retry after the Retry-After header

Rate limits

When a limit is hit the API responds with HTTP 429 Too Many Requests and a Retry-After header (seconds). Recommended client behavior is exponential backoff anchored on that header. Domain-level limits (invites) also surface as inline errors in the HTMX flows.

Model reference

Note: The model reference below is generated from the live OpenAPI spec and is in English regardless of your interface language.