Getting started

Three steps: create a key, make a request, store the key safely.

1. Create a key

In Atla, open Settings → Organization → API keys and click Create key.

• Name it after the system that will use it, for example VMS sync or Reporting warehouse.
• Tick the scopes it needs. Prefer read scopes unless the system must write. A write scope includes its read scope.
• Choose how long it lives: 30, 90, 180 or 365 days. Every key expires.

The full key, which starts with atla_live_, is shown once. Copy it into your secrets manager before closing the dialog. Afterwards only its first 12 characters are visible in Atla.

Pilot

API keys are being rolled out organization by organization. If you do not see API keys under Settings → Organization, ask your Atla contact to enable it for an owner of your organization.

2. First request

GET /profile works with every key and tells you which organization it belongs to and which permissions it holds. Use it to check a key before wiring anything else.

curl -H "Authorization: Bearer atla_live_..." \
  https://app.atlahq.com/api/v1/profile

{
  "id": "6f3b…",
  "email": "key+2c1d…@integrations.atlahq.com",
  "displayName": "API key VMS sync",
  "role": "admin",
  "entitlements": ["member:facilities", "member:needs", "member:orders", "member:shifts"],
  "organizationId": "680e8607-…",
  "organizationName": "Cedar Ridge Staffing"
}

Then read something:

# Every facility
curl -H "Authorization: Bearer atla_live_..." \
  https://app.atlahq.com/api/v1/facilities

# Orders in November, 100 per page
curl -H "Authorization: Bearer atla_live_..." \
  "https://app.atlahq.com/api/v1/orders?from=2026-11-01&to=2026-11-30&page=1&pageSize=100"

And, with a write scope, create a staffing need:

curl -X POST https://app.atlahq.com/api/v1/needs \
  -H "Authorization: Bearer atla_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "facilityId": "0b7c…",
    "title": "RN",
    "specialty": "ICU",
    "shiftDate": "2026-11-03",
    "startTime": "07:00",
    "endTime": "19:00",
    "quantity": 2
  }'

{ "success": true, "id": "9a21…" }

3. Keep the key safe

• A key is as powerful as the scopes it holds. Treat it like an admin password.
• Send it only from a server. Never embed it in a browser, a mobile app or a shared document.
• If a key may have leaked, revoke it immediately in Atla. Revocation takes effect on the next request.
• Before a key expires, create its replacement, switch your system over, then revoke the old one. Atla shows Expiring soon for the last 14 days.

Client code

The reference is an OpenAPI 3.1 document at /openapi.json. Any OpenAPI generator produces a typed client from it. In plain code the whole protocol is one header:

const res = await fetch('https://app.atlahq.com/api/v1/providers', {
  headers: { Authorization: `Bearer ${process.env.ATLA_API_KEY}` },
});
if (!res.ok) {
  const { statusMessage } = await res.json();
  throw new Error(`${res.status} ${statusMessage}`);
}
const providers = await res.json();

import os, requests

r = requests.get(
    "https://app.atlahq.com/api/v1/providers",
    headers={"Authorization": f"Bearer {os.environ['ATLA_API_KEY']}"},
    timeout=30,
)
r.raise_for_status()
providers = r.json()