# API Access
URL: https://usememos.com/docs/integrations/api-access

Every Memos feature is available over the API. To call it programmatically, create a personal access token and send it as a Bearer credential.

## Create a personal access token [#create-a-personal-access-token]

Create and revoke tokens from your **user settings** in the app. Tokens use the `memos_pat_` prefix, and the plain token value is shown only once at creation — store it somewhere safe.

New tokens default to no expiration; you can choose an expiration when creating one. The settings page shows whether each token has ever been used, its last-used time, and its expiration status. Use a separate token for each application so you can revoke one integration without disrupting another.

Tokens are scoped to your user: API calls made with a token can do what your user can do.

## Call the API [#call-the-api]

Pass the token in the `Authorization` header:

```bash
curl -H "Authorization: Bearer memos_pat_..." \
  https://memos.example.com/api/v1/memos
```

For browser-based integrations, bearer-token requests may be sent cross-origin. Cookie authentication remains same-origin; do not build third-party API clients around a user's browser session cookie.

## 0.31 client migration [#031-client-migration]

Review these changes before pointing an existing integration at 0.31:

| Area           | Required client change                                                                                                                                                                                                        |
| -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Views          | Replace `ShortcutService` with the `MemoView` operations in `UserService`, shortcut resources with view resources, and `/api/v1/users/*/shortcuts/*` with `/api/v1/users/*/views/*`. Stored filters migrate automatically.    |
| Authorization  | Run mutations as the memo author. Assigned memo edits also require Space membership; instance and Space admin roles do not override authorship. Users manage their own reactions.                                             |
| Comments       | Send visibility and placement intentionally. `CreateMemoComment` defaults omitted visibility to `PRIVATE`; `SetMemoRelations` rejects `COMMENT`. Parent deletion does not delete comment memos.                               |
| Reactions      | Stop reading `Reaction.content_id` (`contentId` in JSON). Identify the memo from the request or the reaction resource name.                                                                                                   |
| Inline images  | Bind managed attachments to the memo before or during the same mutation that references them in Markdown. An uploaded but unbound attachment is not enough.                                                                   |
| S3 files       | Use the authenticated Memos file route. Managed S3 attachments no longer expose presigned object URLs through `external_link` (`externalLink` in JSON). Preserve share authorization on shared attachment and thumbnail URLs. |
| JSON responses | Allow absent unset protobuf message fields. Scalar defaults and empty lists are still emitted; do not depend on every message field appearing as `null`.                                                                      |
| Usernames      | Use the exact username case for lookup and authentication. See [Users & Roles](/docs/admin/users-roles#usernames).                                                                                                            |

### Spaces in API clients [#spaces-in-api-clients]

A memo's `space` is a resource name such as `spaces/team-notes`, or absent when Unassigned. `visibility: "SPACE"` requires placement in a Space. Filters support `space == null`, `space == "spaces/team-notes"`, and `has_location`.

When moving a `SPACE` memo, include both `space` and `visibility` in the update mask and explicitly confirm `SPACE` visibility for the destination. When withdrawing it to Unassigned, select a non-Space visibility in the same update. Share links cannot be created for `SPACE` memos; revoke existing links before changing a memo to that audience.

The [Latest API reference](/docs/api/latest) tracks `main`, which may include changes after a release candidate. The 0.29 and 0.30 references describe those historical versions. For an exact 0.31.0-rc.1 schema, use the [tagged OpenAPI specification](https://github.com/usememos/memos/blob/v0.31.0-rc.1/proto/gen/openapi.yaml).

## Where to go next [#where-to-go-next]

* [API Reference](/docs/api) — every service and method, REST and gRPC
* [Webhooks](/docs/integrations/webhooks) — push events instead of polling
* [MCP Server](/docs/integrations/mcp) — connect AI assistants using the same tokens
* [Security](/docs/configuration/security) — the full token security model