> For the complete documentation index, see [llms.txt](https://docs.interlynk.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.interlynk.io/api/getting-started/quickstart.md).

# Quickstart

This page walks through a single API call from start to finish. It assumes you have a security token. If you do not, see [Authentication](/api/getting-started/authentication.md).

## 1. Set your token

```bash
export INTERLYNK_SECURITY_TOKEN="lynk_live_xxxxxxxxxxxxxxxxxxxx"
```

## 2. Make a request

The API has one endpoint. You always send a `POST` with a JSON body.

```bash
curl https://api.interlynk.io/lynkapi \
  -H "Authorization: Bearer $INTERLYNK_SECURITY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"query": "query { organization { id name } }"}'
```

```json
{
  "data": {
    "organization": {
      "id": "72219448-e3cf-47f4-8e54-49199fc47f52",
      "name": "Acme Corp"
    }
  }
}
```

## Anatomy of a request

The JSON body has up to three keys:

| Key             | Required | Purpose                                                         |
| --------------- | -------- | --------------------------------------------------------------- |
| `query`         | Yes      | The GraphQL query or mutation string                            |
| `variables`     | No       | Values referenced by the query, as a JSON object                |
| `operationName` | No       | Names the operation when the query string defines more than one |

A request with variables looks like this:

```bash
curl https://api.interlynk.io/lynkapi \
  -H "Authorization: Bearer $INTERLYNK_SECURITY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "query GetSbom($projectId: Uuid!, $sbomId: Uuid!) { sbom(projectId: $projectId, sbomId: $sbomId) { id projectVersion } }",
    "variables": {
      "projectId": "1fade833-0603-4139-8ca0-26592264a4c9",
      "sbomId": "4e423fe0-d089-4025-b1e4-8fe9608138d6"
    },
    "operationName": "GetSbom"
  }'
```

Variables keep IDs and user input out of the query string, which makes requests easier to build and safer to script.

{% hint style="info" %}
Queries read data. Mutations change data. Both go to the same endpoint as a `POST`. Uploads are the one exception: they use `multipart/form-data` instead of a JSON body. See [Upload an SBOM](/api/managing-sboms/upload-sbom.md).
{% endhint %}

## Next steps

* Learn how the platform is organized in the [Data Model](/api/concepts/data-model.md).
* [List your products and versions](/api/inventory/list-resources.md) to get the IDs other calls need.
* [Upload](/api/managing-sboms/upload-sbom.md) or [download](/api/managing-sboms/download-sbom.md) an SBOM.