API Overview - Outlit Docs

Base URL

Outlit exposes two API surfaces:

Surface	Base URL	Authentication
Platform API	`https://app.outlit.ai`	Bearer API key
Ingest API	`https://app.outlit.ai/api/i/v1`	Public key in the URL path

Authentication

Platform API

Platform API routes use an Outlit API key in the Authorization header:

Authorization: Bearer ok_...

Use Platform API routes for customer intelligence tools, integration management, and API key validation:

POST /api/tools/call
GET /api/integrations
POST /api/validate-api-key

The public tool gateway exposes the same customer context tools used by the CLI and agent integrations: complete customer profiles, timelines, facts, exact source lookup, semantic search across sources and facts, and read-only SQL.

Ingest API

The Ingest API uses your public key in the URL path. No additional authentication headers are required for ingestion.

POST /api/i/v1/{publicKey}/events

Your public key is not secret and is safe to include in client-side code. It’s designed to be visible in your website’s source code.

Rate Limits

Ingest API

Limit	Value
Requests per second	100
Events per request	100
Request body size	1 MB

Rate limit headers are included in responses:

X-RateLimit-Limit: 100
X-RateLimit-Remaining: 95
X-RateLimit-Reset: 1699999999

Platform API

Customer intelligence tool calls are authenticated with your Outlit API key and may count toward your plan’s API-call allowance. Integration management routes are authenticated the same way, but integration connections are governed by your plan’s connection limit.

Error Responses

Ingest API errors use the tracking response format:

{
  "success": false,
  "message": "Error description",
  "errors": [
    {
      "path": ["events", 0, "type"],
      "message": "Invalid event type"
    }
  ]
}

Platform API errors use endpoint-specific JSON responses. Most Platform API failures include an error field:

{
  "error": "Invalid credentials"
}

Plan and billing failures include a stable code plus plan metadata:

{
  "error": "Your plan has exhausted its included API calls for the current billing cycle.",
  "code": "api_limit_exceeded",
  "plan": "free",
  "feature": "api_calls",
  "resetAt": 1776124800000
}

HTTP Status Codes

Code	Description
200	Success
400	Invalid request body or parameters
401	Invalid or missing API key
403	Invalid public key, unauthorized domain, or plan connection limit
429	Rate limit exceeded
500	Internal server error

CORS

The Ingest API supports CORS for browser requests. Allowed origins are configured in your tracking settings (Settings -> Website Tracking -> Enabled Domains).

Access-Control-Allow-Origin: https://your-domain.com
Access-Control-Allow-Methods: POST, OPTIONS
Access-Control-Allow-Headers: Content-Type

Available Endpoints

POST /api/validate-api-key

Verify that an Outlit API key can authenticate Platform API requests

POST /api/tools/call

Call customer intelligence tools through the public tool gateway

/api/integrations/*

List, connect, poll, and inspect integration sync status

POST /events

Send tracking events (pageviews, custom events, identify, engagement, calendar, and stage events)

​Base URL

​Authentication

​Platform API

​Ingest API

​Rate Limits

​Ingest API

​Platform API

​Error Responses

​HTTP Status Codes

​CORS

​Available Endpoints

POST /api/validate-api-key

POST /api/tools/call

/api/integrations/*

POST /events

Base URL

Authentication

Platform API

Ingest API

Rate Limits

Ingest API

Platform API

Error Responses

HTTP Status Codes

CORS

Available Endpoints