Skip to main content

​
Authentication

Tenants generate their own personal access token from Account → API Tokens, then authenticate every request with:
Each token is scoped to the tenant account that created it — there’s no way for a token to reach another tenant’s data.

​
Endpoints

The API currently covers websites and reports:
See routes/api.php in your installation for the definitive, current endpoint list — this platform’s roadmap notes the API surface is expected to grow over time.

​
Webhooks

Register your own endpoint URL under Account → Webhook Endpoints to be notified of:
  • report.completed
  • report.failed
Each delivery is a signed JSON POST to your endpoint, with an X-Webhook-Signature header — an HMAC-SHA256 of the raw request body, keyed by your endpoint’s own secret (shown once when you create the endpoint). Verify this signature before trusting a delivery. Failed deliveries are automatically retried with backoff — you don’t need to build your own retry logic for transient failures on your end.