# intouch api
base    https://api.in-touch.cc
auth    X-API-Key: itk_<64 hex>   one key per user, no expiry, no scopes
docs    https://docs.in-touch.cc
format  every response is JSON and carries "success"

# authentication
One personal key per inTouch account. No OAuth, no scopes, no expiry dates.

# header
X-API-Key: itk_3f9c1a0e7b42d85c6109fe23ab7d4410c8e5b6d29f01a374bc58e6d7f2093a1b

header         X-API-Key   (x-api-key is accepted too)
format         itk_ + 64 hex characters
keys per user  exactly one - generating a new one replaces the old one
expiry         none, valid until rotated
scope          all capabilities, for that one account

# where the key comes from
inTouch app > Settings > App & Media > inTouch API.
The screen shows the current key, a copy button and a rotate button.
No endpoint on this API mints keys: key creation stays behind the app login.

# rotation
"Generate new key" deletes the existing key and issues a new one.
The old key stops working immediately -> every integration holding it gets 403.
Rotate when a key leaks or when a tool that had it is no longer used.

# failures
401  {"success":false,"error":"X-API-Key Header fehlt"}
     no header was sent at all
403  {"success":false,"error":"Ungültiger API-Key"}
     header sent, but the key is unknown or was rotated away

Error strings are German and come straight from the backend.
Match on the status code, never on the message text.

# endpoints that require the key
POST /api/addons/recipe/suggest
GET  /api/addons/recipe/history
GET  /api/addons/vocab/profile
POST /api/addons/vocab/push
GET  /api/addons/vocab/history

The app itself talks to many more routes on the same backend. Those are not
part of this API, are not key-authenticated, and must not be called.

# pages
/                  overview, capability list
/quickstart        get a key, first request
/authentication    key format, rotation, failure modes
/conventions       envelope, status codes, limits, dates
/recipes           recipes capability
/vocabulary        vocabulary capability
/roadmap           capability anatomy, what is planned
every page is also plain text: append .txt  (e.g. https://docs.in-touch.cc/vocabulary.txt)
all pages at once: /llms.txt (index) and /llms-full.txt (everything)

# for agents
- Use only the endpoints listed here; do not invent paths, fields or values.
- Check "success" in the body, not just the HTTP status.
- Error strings are German and developer-facing; branch on the status code.
- Batches are accepted partially: read "rejected" and "errors[].index".
- Dates are UTC. Calendar days are YYYY-MM-DD, timestamps are ISO 8601.
- The API key is a credential: never log it, never pass it to a third party.
- Ask the user before writing content into their app for the first time.