Developers

API overview

Traceline exposes a REST API on the same origin as the app. This page describes what is public; a full authenticated reference is available in-product to signed-in administrators.

Public, read-only

No key required — these power the marketing site itself, so they are safe to consume:

• GET /api/public/plans — public plans with per-period prices.
• GET /api/public/pricing — plans + published promotions in one feed.
• GET /api/public/promotions — published promotions only.
• GET /api/health — service health (for uptime monitoring).

Authenticated (tenant)

Organisations generate scoped API keys (prefix tlk_) in the console, with rotation and per-day usage logging. A key authenticates the organisation and is refused by any route that changes credentials or membership. Bearer-token auth on the same REST surface the console uses.

Security

All API traffic is HTTPS; keys can be rotated and revoked; usage is logged. See the security overview.

Reference

The full surface is published as an OpenAPI 3.1 document, generated from the server's own route table — an endpoint cannot exist and be missing from it.

• Browse the API reference — every endpoint, grouped, with its auth scheme.
• GET /api/public/openapi.json — the machine-readable document, for import into Postman, Insomnia or a generator.