# The same API the admin panel runs on

When a feature ships in the interface, its operations are on the API the same day. Everything here is version one, under `/api/v1/`.

Create a [key carrying only the rights the job needs](/content/developers/api#scopes/index.html), name the fields on every read and pace against a concurrency limit rather than a quota.

## Everything you need before the first call.

| What | Value |
| --- | --- |
| Base URL | `https://app.axl.tech/api/v1/`: JSON over HTTPS, REST-flavoured |
| Surface | ~1,100 operations across 60+ modules, the ones the admin panel calls |
| Conventions | String ids, never integers. Mostly 22-character short GUIDs. UTC in every date field, both directions. Soft delete by default: a deleted record is flagged, not erased. Custom fields are read and written by their Latin key. |
| Paging | Reads page with `take` and `skip`; add `useItemsTotal` and the same call returns the count. |
| Response envelope | `{"success":…,"body":…,"errors":[…]}`; every error carries code, type, message and often the field it refers to |
| Documented where | A published [interactive reference](https://app.axl.tech/api/public), generated from a localized OpenAPI document you can download and load into Postman: contacts, courses, products, orders, payments, certificates, scenarios and the partnership endpoints. The rest behave identically, described by the MCP schema tools. |

Read against the running platform and the production configuration.

## What it is for

## Four jobs people wire up first.

- ### Contacts and orders in

From your checkout or back office, using standard fields, tags, groups and custom fields.

- ### Automations from your system

One request runs any active scenario for a contact, carrying your own payload. [The endpoint →](/content/developers/webhooks#inbound/index.html)

- ### Numbers back out

Orders, payments, course progress and campaign results, on your schedule.

- ### Files in and out

Upload the bytes, then attach the file to a lesson or a product.

REST reads and writes; [webhooks](/content/developers/webhooks/index.html) carry events, since there is no subscriptions API. MCP is the same surface for an agent.

## API keys & scopes

## Each key carries its own rights.

Create keys in **Settings → API Keys**, then open one to copy it and set its rights (the same permission tree that governs a human admin, down to the restricted-field right). A key that triggers one automation gets the “run scenario” right and nothing else; it cannot read your contacts.

Keys are unlimited, so one per job costs nothing. REST also keeps the writes that are [removed from the agent surface](/content/developers/agent-guardrails/index.html) (billing, tokens, roles), so a scoped key is how you script that work.

- •The value you copy already includes the `Bearer` prefix. A GET-only caller may pass the raw key as `?admin_access_token=`, but prefer the header; a key in a URL lands in logs.
- •Keys are long-lived: keep one in a secret manager and delete it when the job ends. Deleting the key _is_ the revocation.
- •Agents do not use keys at all. The MCP endpoint runs OAuth 2.1, so nothing long-lived reaches a config file. [The flow →](/content/developers/mcp#auth/index.html)

Choose exactly what an API key can do before you save it.

## First call

## Read fifty contacts in one request.

Fifty contacts, four fields, with the count `GET https://app.axl.tech/api/v1/crm/lead?fields={id,firstName,email,tags{id,text}}&take=50&skip=0&useItemsTotal=true``Authorization: Bearer <your-api-key>``200 {"success":true,"errors":[],"body":{"items":[…],"filter":{"itemsTotal":128}}}` Contacts live under `crm/lead`; the count rides back on the echoed filter. Copy the call

## Files upload in three steps, not one post

**Begin** with a JSON call describing the file; the server sizes the parts and returns one pre-signed URL each. **Upload** the bytes by `PUT` to each URL with **no** `Authorization` header (the signature is in the URL and an auth header voids it), keeping each `ETag` verbatim. **Complete** as the admin who began.

Download links are pre-signed and expire after **six hours**, so generate them when you need them.

## Concurrency, not a request quota

There is no requests-per-second cap. Machine callers get a fixed number of requests **in flight at once**. Ten thousand calls in a row is fine, four at the same moment may not be.

- •Over it: `429` with `Retry-After: 1`, plus `X-Concurrency-Limit` and `X-Concurrency-Remaining`. Read those headers rather than hard-coding a number: they are authoritative for your account right now.
- •Browser sessions are never throttled. The limit stops one runaway script degrading an account; it is not a tier to buy.
- •It fails open: if the throttling layer is unavailable, requests pass through.
- •A negative balance locks the API: everything but billing reads answers `403 lockedSchoolAccessDenied`, and no backoff clears it. A failed invoice stops a nightly job until the account is [topped up](/content/pricing/index.html).

## Questions

## Before you wire anything up.

### Where is the endpoint reference?

At [app.axl.tech/api/public](https://app.axl.tech/api/public), browsable and open, with the OpenAPI document downloadable from the same page. It covers contacts, courses, products, orders, payments, certificates, scenarios and the partnership endpoints; everything else behaves the same way and is described by the MCP schema tools and the [knowledge base](https://docs.axl.tech/).

### Is the API included, or is there a developer tier?

The API and webhooks are part of AXL. Paid platform plans start at $49 per month with included usage and published overage rates. [Work out your number →](/content/pricing/index.html)

### Do you have SDKs?

Not today. Download the OpenAPI document from the [reference](https://app.axl.tech/api/public) and generate one in your own language; the same file imports into Postman as a collection.

## One key, one job, one afternoon.

Create the key, scope it to the one job, make the call above.

[Create an API key](https://docs.axl.tech/api-keys) [Open the API reference](https://app.axl.tech/api/public) [Webhooks, both directions](/content/developers/webhooks/index.html)

Free plan, no card needed.