API Overview - Outlit Docs

Base URL

Outlit exposes two API surfaces:

Surface	Base URL	Authentication
Platform API	`https://app.outlit.ai`	Bearer API key
Ingest API	`https://app.outlit.ai/api/i/v1`	Public key in the URL path

Download the canonical OpenAPI spec for schema-driven clients, crawlers, and API discovery.

Authentication

Platform API

Platform API routes use an Outlit API key in the Authorization header:

Authorization: Bearer ok_...

Use the public tool gateway for every model-safe capability and the validation route for API-key checks:

POST /api/tools/call
POST /api/validate-api-key

The public tool gateway exposes the same exact catalog used by the CLI and agent integrations: customer intelligence, destinations, safe integration handoffs and status, activation configuration, workspace settings, and read-only SQL. Platform Configuration exposes destination and selected workspace-setting routes that are also available through the CLI.

Ingest API

The Ingest API uses your public key in the URL path. No additional authentication headers are required for ingestion.

POST /api/i/v1/{publicKey}/events

Your public key is not secret and is safe to include in client-side code. It’s designed to be visible in your website’s source code.

Rate Limits

Ingest API

Limit	Value
Requests per second	100
Events per request	100
Request body size	1 MB

Rate limit headers are included in responses:

X-RateLimit-Limit: 100
X-RateLimit-Remaining: 95
X-RateLimit-Reset: 1699999999

Platform API

Capability calls are authenticated with your Outlit API key and may count toward your plan’s API-call allowance.

Error Responses

Ingest API errors use the tracking response format:

{
  "success": false,
  "message": "Error description",
  "errors": [
    {
      "path": ["events", 0, "type"],
      "message": "Invalid event type"
    }
  ]
}

The tool gateway uses one stable redacted error envelope:

{
  "code": "TOOL_CALL_FORBIDDEN",
  "message": "Capability not authorized",
  "retryable": false,
  "requestId": "request_123"
}

HTTP Status Codes

Code	Description
200	Success
400	Invalid request body or parameters
401	Invalid or missing API key
403	Invalid public key, unauthorized domain, or plan connection limit
429	Rate limit exceeded
500	Internal server error

CORS

The Ingest API supports CORS for browser requests. Allowed origins are configured in your tracking settings (Settings -> Website Tracking -> Enabled Domains).

Access-Control-Allow-Origin: https://your-domain.com
Access-Control-Allow-Methods: POST, OPTIONS
Access-Control-Allow-Headers: Content-Type

Available Endpoints

POST /api/validate-api-key

Verify that an Outlit API key can authenticate Platform API requests

POST /api/tools/call

Call customer intelligence tools through the public tool gateway

Integration tools

Negotiate bounded setup and inspect canonical configuration readiness through the gateway

Platform capabilities

Manage masked destinations, activation, and selected workspace settings through the gateway

POST /events

Send tracking events (pageviews, custom events, identify, engagement, and calendar events)

​Base URL

​Authentication

​Platform API

​Ingest API

​Rate Limits

​Ingest API

​Platform API

​Error Responses

​HTTP Status Codes

​CORS

​Available Endpoints

POST /api/validate-api-key

POST /api/tools/call

Integration tools

Platform capabilities

POST /events

Base URL

Authentication

Platform API

Ingest API

Rate Limits

Ingest API

Platform API

Error Responses

HTTP Status Codes

CORS

Available Endpoints