Developers.
The real third-party API surface, exactly as it exists today — not a roadmap dressed up as documentation.
/api/v1 surface actually built for external integrations.Authentication
Create an API key from your organization’s settings (Owner/Admin only). Each key carries an explicit, non-empty list of scopes — the same permission strings the product enforces everywhere else (e.g. posts.read, posts.create) — so a key never defaults to full access. The raw key is shown once at creation and can’t be retrieved again; only its hash is stored.
curl https://<your-domain>/api/v1/posts \ -H "Authorization: Bearer nua_live_..."
Rate limit: 300 requests/minute per key. Session cookies are never accepted on /api/v1 routes, and API keys are never accepted on the session-authenticated dashboard routes — the two never cross.
Endpoints
This is the whole /api/v1 surface today — two routes, both on posts. Every response uses the same envelope: { success, data, error, requestId }.
| Method | Path | Notes |
|---|---|---|
| GET | /api/v1/posts | List an organization’s posts. Filters: status, platform, search, page, pageSize. |
| POST | /api/v1/posts | Create a post. Same request body as the dashboard’s own POST /api/posts. |
Nothing beyond posts is built on /api/v1 yet — no accounts, media, or analytics endpoints on this key-authenticated surface. The full internal API shape (everything the dashboard itself calls) is documented, for reference, in the engineering docs below.
Outbound webhooks
Subscribe a URL to receive events as they happen, from your organization’s settings. Two event types exist today:
post.published— Fires when a post successfully publishes to a platform.analytics.synced— Fires when an analytics sync for a connected account completes.
Each delivery is a signed POST: X-NUA-Signature: sha256=<hmac> is an HMAC-SHA256 of the raw body using your subscription’s secret (shown once at creation, the same discipline as an API key), plus X-NUA-Event and X-NUA-Delivery-Id headers. A failed delivery retries up to 5 times with exponential backoff; a delivery-history view isn’t built in the dashboard yet.
Full reference
The complete internal API index and machine-readable OpenAPI spec (covers the dashboard’s own session-authenticated routes, not just /api/v1) are kept in the engineering documentation: