> ## Documentation Index
> Fetch the complete documentation index at: https://docs.outlit.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Outlit is the product that monitors customers and completes approved customer work. The customer context interfaces are the API, CLI, MCP server, and skills. Canonical references on this site: /api-reference/introduction for API concepts and authentication, /openapi.json for the public API contract, /cli/overview for the CLI, /ai-integrations/mcp for MCP. Prefer the `outlit` CLI or MCP tools for agent tasks; cite page sources when answering.

# API overview

> Direct API access for custom integrations.

## Base URL

Outlit exposes two API surfaces:

| Surface | Base URL | Authentication |
| - | - | - |
| Platform API | `https://app.outlit.ai` | Bearer API key |
| Ingest API | `https://app.outlit.ai/api/i/v1` | Public key in the URL path |

[Download the canonical OpenAPI spec](/openapi.json) for schema-driven clients, crawlers, and API discovery.

## Authentication

### Platform API

Platform API routes use an Outlit API key in the `Authorization` header:

```http theme={null}
Authorization: Bearer ok_...
```

Use the public tool gateway for supported customer and workspace actions and the validation route for API-key checks:

```http theme={null}
POST /api/tools/call
POST /api/validate-api-key
```

The public tool gateway publishes the full catalog: customer intelligence, destinations, integration setup and status, activation configuration, workspace settings, and read-only SQL. CLI and agent integrations can expose selected subsets of these tools.

[Workspace configuration](/ai-integrations/platform-actions) explains destination and workspace-setting tools that are also available through the CLI.

### Ingest API

The Ingest API uses your **public key** in the URL path. No additional authentication headers are required for ingestion.

```
POST /api/i/v1/{publicKey}/events
```

<Info>
  Your public key is **not secret** and is safe to include in client-side code. It's designed to be visible in your website's source code.
</Info>

## Limits

### Ingest API

The verified contract limit is **100 events per request** — larger batches are rejected by schema validation. Send events in batches of 100 or fewer.

Handle responses by status class, not by a promise of specific headers:

* `4xx` other than `429` (validation `400`, auth `401`/`403`, invalid public key or domain) — **do not retry**; these are permanent until the request or credentials change
* `207` (ingest partial success) — inspect the body's `processed` count and per-event errors; correct the failed events before retrying them, and never resubmit the batch blindly
* network failures, `429`, and `5xx` — retryable; use bounded exponential backoff

Per-key rate-limit headers are not part of the documented contract; don't build on their presence.

### Platform API

Capability calls are authenticated with your Outlit API key and may count toward your plan's API-call allowance. Plan-limit failures surface through the tool gateway's error envelope (see below) rather than through ingest-style tracking responses.

## Error responses

Ingest API errors use the tracking response format:

```json theme={null}
{
  "success": false,
  "message": "Error description",
  "errors": [
    {
      "path": ["events", 0, "type"],
      "message": "Invalid event type"
    }
  ]
}
```

The tool gateway uses one stable redacted error envelope:

```json theme={null}
{
  "code": "TOOL_CALL_FORBIDDEN",
  "message": "Capability not authorized",
  "retryable": false,
  "requestId": "request_123"
}
```

### HTTP status codes

| Code | Description |
| - | - |
| 200 | Success |
| 207 | Some ingest events succeeded; inspect per-event errors |
| 400 | Invalid request body or parameters |
| 401 | Invalid or missing API key |
| 402 | Plan or API-call allowance exceeded, where enforced |
| 403 | Invalid public key, unauthorized domain, or plan connection limit |
| 429 | Platform limit applied (where enforced) — retry with backoff |
| 500 | Internal server error |
| 503 | Service unavailable; retry with backoff |

## CORS

The Ingest API supports CORS for browser requests. Allowed origins are configured in your tracking settings [**Settings → Website Visitors → Enabled Domains**](https://app.outlit.ai/settings/workspace/website-visitors).

```
Access-Control-Allow-Origin: https://your-domain.com
Access-Control-Allow-Methods: POST, OPTIONS
Access-Control-Allow-Headers: Content-Type
```

## Available endpoints

<CardGroup cols={2}>
  <Card title="Validate an API key" icon="key" href="/api-reference/validation">
    Check whether a key can authenticate API requests.
  </Card>

  <Card title="Call a tool" icon="terminal" href="/api-reference/tools">
    Read customer context or perform an authorized action.
  </Card>

  <Card title="Integration tools" icon="plug" href="/api-reference/integrations">
    Set up a provider and check configuration readiness.
  </Card>

  <Card title="Ingest events" icon="arrow-right" href="/api-reference/ingest">
    Send browser or server tracking events.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.