Skip to content

Docs

REST API

Endpoints, authentication, error envelope, pagination and rate limits.

The REST API powers the dashboard, hosted portal and widget. It is versioned under /api/v1. Public API tokens for server-to-server use are coming soon; today, workspace endpoints use your signed-in dashboard session.

Authentication

  • Dashboard API (/api/v1/…): secure session cookie plus the X-CSRF-TOKEN header on writes. Every workspace route requires membership and the right role.
  • Widget API (https://ext0.com/w/api/v1/…): short-lived bearer token from a guest or identified widget session. It can never perform staff actions.

Response envelope

{
  "data": { "id": "01JEXAMPLEULID", "title": "Dark mode" },
  "meta": { "request_id": "req_…" }
}

Errors

{
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Please correct the highlighted fields.",
    "fields": { "title": ["Title is required."] }
  },
  "meta": { "request_id": "req_…" }
}
StatusCodeMeaning
401UNAUTHENTICATED, IDENTITY_REQUIREDSign-in or visitor verification needed
402PLAN_LIMITYour plan does not include this, or a quota is reached
403FORBIDDENYour role cannot perform this action
404NOT_FOUNDMissing — or hidden from you
409CONFLICTState conflict or duplicate idempotency key in progress
422VALIDATION_ERRORField errors in fields
429RATE_LIMITEDSlow down and retry later

Pagination and idempotency

List endpoints accept limit (max 100) and return a next_cursor; pass it back as cursor. Sensitive writes such as checkout accept an Idempotency-Key header; repeating a key replays the original response.

Endpoints

Account

  • POST /api/v1/auth/signup
  • POST /api/v1/auth/login
  • POST /api/v1/auth/logout
  • POST /api/v1/auth/verify-email
  • POST /api/v1/auth/forgot-password
  • POST /api/v1/auth/reset-password
  • GET /api/v1/me
  • GET /api/v1/workspaces
  • POST /api/v1/workspaces
  • GET /api/v1/workspaces/{workspaceId}
  • PATCH /api/v1/workspaces/{workspaceId}
  • GET /api/v1/workspaces/{workspaceId}/members
  • POST /api/v1/workspaces/{workspaceId}/invites
  • DELETE /api/v1/workspaces/{workspaceId}/members/{memberId}
  • GET|PATCH /api/v1/workspaces/{workspaceId}/settings

Feedback

  • GET /api/v1/workspaces/{workspaceId}/feedback
  • GET|PATCH /api/v1/workspaces/{workspaceId}/feedback/{feedbackId}
  • POST /api/v1/workspaces/{workspaceId}/feedback/{feedbackId}/merge
  • POST /api/v1/workspaces/{workspaceId}/feedback/{feedbackId}/comments
  • GET /api/v1/workspaces/{workspaceId}/moderation
  • POST /api/v1/workspaces/{workspaceId}/moderation/{itemId}/approve|reject
  • GET|POST /api/v1/workspaces/{workspaceId}/categories

Roadmap & changelog

  • GET /api/v1/workspaces/{workspaceId}/roadmap
  • POST /api/v1/workspaces/{workspaceId}/roadmap/items
  • PATCH /api/v1/workspaces/{workspaceId}/roadmap/items/{itemId}
  • POST /api/v1/workspaces/{workspaceId}/roadmap/items/{itemId}/feedback-links
  • GET|POST /api/v1/workspaces/{workspaceId}/changelog
  • PATCH /api/v1/workspaces/{workspaceId}/changelog/{entryId}
  • POST /api/v1/workspaces/{workspaceId}/changelog/{entryId}/publish

Surveys & analytics

  • GET|POST /api/v1/workspaces/{workspaceId}/surveys
  • PATCH /api/v1/workspaces/{workspaceId}/surveys/{surveyId}
  • POST /api/v1/workspaces/{workspaceId}/surveys/{surveyId}/publish|close
  • GET /api/v1/workspaces/{workspaceId}/surveys/{surveyId}/responses|report
  • GET /api/v1/workspaces/{workspaceId}/analytics/overview

Billing & widget

  • GET /api/v1/workspaces/{workspaceId}/billing
  • POST /api/v1/workspaces/{workspaceId}/billing/checkout
  • POST /api/v1/workspaces/{workspaceId}/billing/portal-session
  • GET /api/v1/workspaces/{workspaceId}/usage
  • GET /api/v1/workspaces/{workspaceId}/widget/install
  • PATCH /api/v1/workspaces/{workspaceId}/widget/config
  • POST /api/v1/workspaces/{workspaceId}/widget/rotate-identity-secret

Widget (public)

  • GET /w/api/v1/config/{publicWorkspaceKey}
  • POST /w/api/v1/sessions/guest|identify|logout
  • GET|POST /w/api/v1/{key}/feedback
  • GET /w/api/v1/{key}/feedback/{feedbackId}
  • PUT|DELETE /w/api/v1/{key}/feedback/{feedbackId}/vote
  • POST /w/api/v1/{key}/feedback/{feedbackId}/comments|subscribe
  • GET /w/api/v1/{key}/roadmap
  • GET /w/api/v1/{key}/changelog[/{entryId}]
  • GET /w/api/v1/{key}/surveys[/{surveyId}]
  • POST /w/api/v1/{key}/surveys/{surveyId}/impressions|responses

Workspace ids in URLs are public ULIDs. Numeric internal ids are never exposed.