Authentication

Every request to a Fusion API must include a Red Bricks API key as a
bearer token:

Authorization: Bearer rb_live_xxxxxxxxxxxxxxxxxxxxxxxx

cURL

curl https://api.redbricks.dev/api/v1/building-links/12345 \
  -H "Authorization: Bearer rb_live_xxxxxxxxxxxxxxxxxxxxxxxx"

The Bearer prefix is recommended but optional — a bare token in the
Authorization header is also accepted.

Scopes

A single API key carries a set of scopes (abilities). A key can hold any
subset of the scopes your team is entitled to — you do not need a separate
key per API. The Fusion API scopes are:

Scope	Grants access to
building-links	Building Link API
floorplan-match	Floor Plan Match API

If your key is missing the scope for the endpoint you call, you get a
403:

JSON

{ "message": "API token is not scoped for 'building-links'" }

Plan tiers

Both Fusion API scopes require a Pro or Elite subscription. The plan is
re-checked on every request, so if a team downgrades, access stops
immediately even though the scope is still on the key.

If your plan doesn't include the scope, you get a 403 with an
upgrade_required flag:

JSON

{
  "message": "The 'floorplan-match' API requires a Pro or Elite plan.",
  "scope": "floorplan-match",
  "upgrade_required": true
}

Generating a key

Scoped API keys are created from your Red Bricks team settings (API Keys). When
creating a key, select the Fusion scopes you want it to carry. Fusion scopes
are only selectable on Pro/Elite plans.

🔑

Treat API keys as secrets. Don't commit them to source control or expose

them in client-side code. Rotate a key immediately if it leaks.

Error responses

All Fusion APIs return errors as JSON with an appropriate HTTP status.

Status	Meaning	Example body
401	No token supplied	{ "message": "API token is required" }
401	Token invalid, inactive, or expired	{ "message": "Invalid or expired API token" }
403	Key not scoped for this API	{ "message": "API token is not scoped for 'building-links'" }
403	Plan tier too low for this scope	{ "message": "The 'floorplan-match' API requires a Pro or Elite plan.", "scope": "floorplan-match", "upgrade_required": true }
422	Request body failed validation	{ "message": "...", "errors": { "field": ["..."] } }
429	Rate limit exceeded	(empty body; see headers below)

Rate limits

Limits are per API key, per minute.

API	Limit
Building Link API	120 requests / minute
Floor Plan Match API	1,000 requests / minute

The Floor Plan Match limit is higher because a single page render often fans out
into many match calls. Remember you can match up to 100 listings in one
request — batching is the most efficient way to stay under the limit.

When you exceed a limit you get a 429 Too Many Requests. Standard rate-limit
headers tell you when to retry:

Header	Meaning
X-RateLimit-Limit	Max requests allowed in the window
X-RateLimit-Remaining	Requests left in the current window
Retry-After	Seconds to wait before retrying (on 429)