REST API Reference

FleetQ exposes a versioned REST API at /api/v1/ with 175+ endpoints across 30 resource groups. All endpoints return JSON and follow standard HTTP conventions.

Open Interactive API Explorer →

Authentication

All API requests require a Bearer token. Create tokens in Team Settings → API Tokens. Tokens are scoped to your team — a token from Team A cannot access Team B's resources.

bash

curl -H "Authorization: Bearer YOUR_TOKEN" \
     https://fleetq.169.58.89.204.sslip.io/api/v1/experiments

Base URL

https://fleetq.169.58.89.204.sslip.io/api/v1

Rate limits

Per-tenant rate limits apply. When exceeded, you receive 429 Too Many Requests. Check the Retry-After header for the cooldown period. The login endpoint is additionally throttled at 5 requests per minute.

Pagination

All list endpoints use cursor-based pagination:

bash

# First page
GET /api/v1/experiments?per_page=20

# Next page (use cursor from previous response)
GET /api/v1/experiments?per_page=20&cursor=eyJpZCI6Miwic3RhcnQiOmZhbHNlfQ

Paginated response shape

{
  "data": [...],
  "links": {
    "prev": null,
    "next": "https://fleetq.net/api/v1/experiments?cursor=eyJpZCI6Miwic3RhcnQiOmZhbHNlfQ"
  },
  "meta": {
    "per_page": 20,
    "path": "https://fleetq.net/api/v1/experiments"
  }
}

Error codes

Code	Meaning
200	Success
201	Created — resource successfully created
401	Unauthenticated — missing or invalid Bearer token
403	Forbidden — token doesn't have permission for this resource
404	Not found — resource doesn't exist or is not visible to your team
422	Validation error — response body contains field-level error messages
429	Rate limit exceeded — check Retry-After header
500	Server error — if this persists, contact support

Webhook signature verification

Inbound webhook signals use HMAC-SHA256 signatures. The X-Signature header contains sha256=<hex_digest> computed over the raw request body. Additionally, X-Webhook-Timestamp must be within 5 minutes of the current time to prevent replay attacks.