API overview - Outlit

Base URL

Outlit exposes two API surfaces:

Surface	Base URL	Authentication
Platform API	`https://app.outlit.ai`	Bearer API key
Ingest API	`https://app.outlit.ai/api/i/v1`	Public key in the URL path

Download the canonical OpenAPI spec for schema-driven clients, crawlers, and API discovery.

Authentication

Platform API

Platform API routes use an Outlit API key in the Authorization header:

Authorization: Bearer ok_...

Use the public tool gateway for supported customer and workspace actions and the validation route for API-key checks:

POST /api/tools/call
POST /api/validate-api-key

The public tool gateway publishes the full catalog: customer intelligence, destinations, integration setup and status, activation configuration, workspace settings, and read-only SQL. CLI and agent integrations can expose selected subsets of these tools. Workspace configuration explains destination and workspace-setting tools that are also available through the CLI.

Ingest API

The Ingest API uses your public key in the URL path. No additional authentication headers are required for ingestion.

POST /api/i/v1/{publicKey}/events

Your public key is not secret and is safe to include in client-side code. It’s designed to be visible in your website’s source code.

Limits

Ingest API

The verified contract limit is 100 events per request — larger batches are rejected by schema validation. Send events in batches of 100 or fewer. Handle responses by status class, not by a promise of specific headers:

4xx other than 429 (validation 400, auth 401/403, invalid public key or domain) — do not retry; these are permanent until the request or credentials change
207 (ingest partial success) — inspect the body’s processed count and per-event errors; correct the failed events before retrying them, and never resubmit the batch blindly
network failures, 429, and 5xx — retryable; use bounded exponential backoff

Per-key rate-limit headers are not part of the documented contract; don’t build on their presence.

Platform API

Capability calls are authenticated with your Outlit API key and may count toward your plan’s API-call allowance. Plan-limit failures surface through the tool gateway’s error envelope (see below) rather than through ingest-style tracking responses.

Error responses

Ingest API errors use the tracking response format:

{
  "success": false,
  "message": "Error description",
  "errors": [
    {
      "path": ["events", 0, "type"],
      "message": "Invalid event type"
    }
  ]
}

The tool gateway uses one stable redacted error envelope:

{
  "code": "TOOL_CALL_FORBIDDEN",
  "message": "Capability not authorized",
  "retryable": false,
  "requestId": "request_123"
}

HTTP status codes

Code	Description
200	Success
207	Some ingest events succeeded; inspect per-event errors
400	Invalid request body or parameters
401	Invalid or missing API key
402	Plan or API-call allowance exceeded, where enforced
403	Invalid public key, unauthorized domain, or plan connection limit
429	Platform limit applied (where enforced) — retry with backoff
500	Internal server error
503	Service unavailable; retry with backoff

CORS

The Ingest API supports CORS for browser requests. Allowed origins are configured in your tracking settings Settings → Website Visitors → Enabled Domains.

Access-Control-Allow-Origin: https://your-domain.com
Access-Control-Allow-Methods: POST, OPTIONS
Access-Control-Allow-Headers: Content-Type

Available endpoints

Validate an API key

Check whether a key can authenticate API requests.

Call a tool

Read customer context or perform an authorized action.

Integration tools

Set up a provider and check configuration readiness.

Ingest events

Send browser or server tracking events.

​Base URL

​Authentication

​Platform API

​Ingest API

​Limits

​Ingest API

​Platform API

​Error responses

​HTTP status codes

​CORS

​Available endpoints

Validate an API key

Call a tool

Integration tools

Ingest events

Base URL

Authentication

Platform API

Ingest API

Limits

Ingest API

Platform API

Error responses

HTTP status codes

CORS

Available endpoints