DevPulse
openapi.json (3.1)

API Reference

v1.0.0OpenAPI 3.1.0

Authenticate with the OAuth 2.0 client credentials grant (RFC 6749 §4.4) at /oauth/token, then send Authorization: Bearer <token> (RFC 6750). Tokens are short-lived JWTs (RFC 9068) scoped to resource:action permissions and optionally to projects; revoke them at /oauth/revoke (RFC 7009).

Errors use Problem Details (RFC 9457). Rate limits are advertised with RateLimit / RateLimit-Policy headers; exceeding them returns 429 with Retry-After. Creating something the organization's plan doesn't include (a feature, or more projects or monitors than it allows) returns 402 with requiredPlan in the problem details.

Pagination: list endpoints return { items, nextCursor }. Pass ?limit= (1–500, default 100) and the opaque ?cursor= from the previous page; the next page is also linked in an RFC 8288 Link: <…>; rel="next" header. A few endpoints page by time instead (?before=), noted on the operation.

Transport: HTTPS only (HSTS). Secrets, credentials and contact details are encrypted at rest with AES-256-GCM.

OAuth 2.0 Auth

Client credentials grant yielding short-lived ES256 JWTs. Fine-grained resource:action scopes.

RFC 6749 / RFC 9068
Problem Details

Standard RFC 9457 JSON errors with machine-readable status, title, detail, and validation arrays.

RFC 9457 / HTTP 4xx, 5xx
Rate Limits

IETF headers RateLimit and RateLimit-Policy are sent on all responses. Exceeding returns HTTP 429 with Retry-After.

600 req/min default
Cursor Pagination

List collections with ?cursor= and ?limit=. Next page is also provided in an RFC 8288 Link header.

RFC 8288 Link header

Authentication & Tokens

All API requests must be authenticated using an access token obtained via OAuth 2.0 Client Credentials or a dedicated feature key (SDK key, service token, or log token).

Example Request Workflow
# 1. Exchange client credentials for an access token (RFC 6749 §4.4)
curl -s -X POST https://your-devpulse-host/oauth/token \
  -u "$CLIENT_ID:$CLIENT_SECRET" \
  -d grant_type=client_credentials \
  -d scope="project:read flag:read"     # optional: request a subset

# 2. Call the API with the bearer token (RFC 6750)
curl -s https://your-devpulse-host/api/v1/projects \
  -H "Authorization: Bearer $ACCESS_TOKEN"

Offline JWKS Verification

Tokens are signed with ES256. Public keys are available at /.well-known/jwks.json for fast local verification.

Introspection & Revocation

Introspect tokens with POST /oauth/introspect (RFC 7662) and revoke client credentials via POST /oauth/revoke (RFC 7009).

Authorization Metadata

Server metadata discovery is hosted at /.well-known/oauth-authorization-server (RFC 8414).

Method:
Showing 263 of 263 endpoints

Core & Projects

12

Organization projects, environments, identity, and immutable audit logging.

Feature Flags & Targeting

50

Boolean and multivariate flags, rule targeting, segments, experiments, code references, webhooks, and client/server SDK evaluation streams.

Status Pages & Incidents

40

Public and private status pages, components, incidents, maintenance schedules, subscribers, system metrics, and deploy markers.

Error Tracking

22

Sentry-compatible error ingestion, issue grouping, stack trace inspection, source maps, and release tracking.

Logs & Ingestion

11

HTTP log drains, OpenTelemetry & Syslog ingestion, structured log searching, live tailing, and log alert rules.

Cron Monitoring

11

Heartbeat monitoring for scheduled jobs, run durations, failure reporting, and alert channels.

Webhook Inspector

12

Capture endpoints for testing inbound webhooks, inspection, request replay, and SSE streaming.

Public Changelogs

20

Product changelog management, categories, publishing workflows, subscriber notifications, and public feeds.

Secrets Management

12

Encrypted environment variables, envelope encryption, version history, and scoped service tokens.

Mock APIs

10

Mock REST API endpoints generated from OpenAPI specifications with schema validation and response overriding.

On-Call & Escalation

18

On-call rotation schedules, escalation policies, paging triggers, and iCalendar schedule feeds.

Product Analytics

21

PostHog-compatible event ingestion, insights, dashboards, persons, retention cohorts, and funnel analytics.

Feedback & Roadmap

16

User feedback boards, voting, roadmap milestones, duplicate post merging, and SSO integration.