Skip to main content

What's documented

This page is a completeness map: every REST endpoint the API serves and every webhook event it emits, with a link to where each is covered. The authoritative, always-current contract is the OpenAPI spec at /api/v1/openapi.json.

  • [x] — live on api.short.leonai.io and described in the OpenAPI spec.
  • [ ] — not implemented. The path returns 404 today. These were listed as available in an earlier revision of this page; they are kept, unticked, so it is obvious they are planned rather than silently missing. Do not build against them.

Auth — /api/v1/auth · Authentication​

  • POST /api/v1/auth/signup
  • POST /api/v1/auth/login
  • POST /api/v1/auth/refresh
  • POST /api/v1/auth/logout
  • POST /api/v1/auth/logout-all — not implemented, returns 404
  • GET /api/v1/auth/me
  • GET /api/v1/me — caller identity, plan and API-key scopes; any valid API key
  • POST /api/v1/auth/verify-email
  • POST /api/v1/auth/resend-verification
  • POST /api/v1/auth/forgot-password
  • POST /api/v1/auth/reset-password
  • POST /api/v1/auth/register — alias of /auth/signup
  • GET /api/v1/auth/oauth/providers — which SSO providers are configured
  • GET /api/v1/auth/oauth/:provider/start — begin an SSO login
  • GET /api/v1/auth/oauth/:provider/callback — provider redirect target
  • POST /api/v1/auth/oauth/exchange — trade the one-time code for a session

2FA — /api/v1/auth/2fa · 2FA​

  • POST /api/v1/auth/2fa/setup
  • POST /api/v1/auth/2fa/enable
  • POST /api/v1/auth/2fa/disable
  • GET /api/v1/auth/2fa/status
  • POST /api/v1/auth/2fa/verify

API keys — /api/v1/api-keys · Authentication​

  • POST /api/v1/api-keys
  • GET /api/v1/api-keys
  • PATCH /api/v1/api-keys/:id
  • DELETE /api/v1/api-keys/:id

Users / GDPR — /api/v1/users​

  • GET /api/v1/users/me/export — GDPR data export
  • DELETE /api/v1/users/me — right to erasure
  • GET /api/v1/users/me/consent — effective cookie/marketing consent
  • PUT /api/v1/users/me/consent — record a decision. Append-only: a withdrawal adds a row rather than editing the grant, so the proof that earlier processing was lawful survives the opt-out (5-year retention).

Links — /api/v1/links · Links​

  • POST /api/v1/links
  • GET /api/v1/links
  • GET /api/v1/links/:id (id or short code)
  • PATCH /api/v1/links/:id
  • DELETE /api/v1/links/:id
  • GET /api/v1/links/:id/stats — not implemented, returns 404
  • POST /api/v1/links/bulk — CSV or pre-parsed rows, max 1000, per-row results
  • GET /api/v1/links/export — CSV or JSON attachment, max 10,000
  • GET /api/v1/links?folderId={id|root} — filter by folder

Folders — /api/v1/folders · Folders​

  • POST /api/v1/folders
  • GET /api/v1/folders
  • PATCH /api/v1/folders/:id
  • DELETE /api/v1/folders/:id
  • PUT /api/v1/folders/:id/links

Analytics & conversions — /api/v1/analytics · Analytics​

  • GET /api/v1/analytics/links/:id
  • GET /api/v1/analytics/account
  • GET /api/v1/analytics/realtime/:id — not implemented, returns 404
  • GET /api/v1/analytics/export/:id — not implemented, returns 404
  • GET /api/v1/analytics/summary — not implemented, returns 404
  • GET /api/v1/analytics/conversions/summary
  • GET /api/v1/analytics/:linkId/conversions
  • POST /api/v1/conversions — API-key only, Business+ (was listed here as /api/v1/track/conversions, which returns 404)

Shareable analytics — /api/v1/analytics/.../share · Shareable analytics​

  • POST /api/v1/analytics/:linkId/share
  • GET /api/v1/analytics/:linkId/share
  • DELETE /api/v1/analytics/shares/:id

Retargeting pixels — /api/v1/pixels · Retargeting pixels​

  • POST /api/v1/pixels
  • GET /api/v1/pixels
  • PATCH /api/v1/pixels/:id
  • DELETE /api/v1/pixels/:id
  • GET /api/v1/links/:linkId/pixels
  • PUT /api/v1/links/:linkId/pixels

Branding — /api/v1/branding · White-label branding​

  • GET /api/v1/branding
  • PUT /api/v1/branding — Enterprise

Imports — /api/v1/imports · Import from Bitly​

  • POST /api/v1/imports/bitly

Smart routing — /api/v1/links/:linkId/routing · Smart routing​

  • POST /api/v1/links/:linkId/routing
  • GET /api/v1/links/:linkId/routing
  • GET /api/v1/links/:linkId/routing/:ruleId
  • PATCH /api/v1/links/:linkId/routing/:ruleId
  • DELETE /api/v1/links/:linkId/routing/:ruleId
  • GET /api/v1/links/:linkId/ab-report — per-variant clicks and uplift

Custom domains — /api/v1/domains · Custom domains​

  • POST /api/v1/domains
  • GET /api/v1/domains
  • GET /api/v1/domains/:id
  • POST /api/v1/domains/:id/verify
  • DELETE /api/v1/domains/:id
  • PATCH /api/v1/domains/:id
  • GET /api/v1/domains/:id/verification — the TXT record to publish
  • GET /api/v1/domains/providers — not implemented, returns 404. Superseded by detect-provider, which reports the provider for the domain you actually have rather than making you match it against a catalogue.
  • GET /api/v1/domains/:id/setup/:providerId — not implemented, returns 404. Superseded by auto-configure (Cloudflare) and the per-provider instructions the dashboard renders for everyone else.
  • GET /api/v1/domains/:id/detect-provider — live NS lookup
  • POST /api/v1/domains/:id/auto-configure — one-click Cloudflare. Takes a apiToken in the body, uses it for that one request, and discards it — nothing is stored, so reconnecting later asks for it again.

Webhooks — /api/v1/webhooks · Webhooks​

  • POST /api/v1/webhooks
  • GET /api/v1/webhooks
  • GET /api/v1/webhooks/:id
  • PATCH /api/v1/webhooks/:id
  • DELETE /api/v1/webhooks/:id
  • GET /api/v1/webhooks/:id/deliveries — recent attempts with status and response code

AI — /api/v1/ai · AI features​

  • POST /api/v1/ai/suggest-slug — not implemented, returns 404
  • POST /api/v1/ai/insights — Business+ — not implemented, returns 404
  • POST /api/v1/ai/anomalies — not implemented, returns 404
  • GET /api/v1/ai/status — not implemented, returns 404

Teams — /api/v1/teams · Teams​

  • POST /api/v1/teams
  • GET /api/v1/teams
  • GET /api/v1/teams/:teamId/members
  • POST /api/v1/teams/:teamId/invites
  • GET /api/v1/teams/:teamId/invites
  • DELETE /api/v1/teams/:teamId/invites/:inviteId
  • POST /api/v1/teams/invites/accept
  • DELETE /api/v1/teams/:teamId/members/:memberId
  • PATCH /api/v1/teams/:teamId/members/:memberId

Bio pages — /api/v1/bio-pages · Link-in-bio​

  • POST /api/v1/bio-pages
  • GET /api/v1/bio-pages
  • GET /api/v1/bio-pages/:id
  • PATCH /api/v1/bio-pages/:id
  • DELETE /api/v1/bio-pages/:id
  • POST /api/v1/bio-pages/:id/publish
  • POST /api/v1/bio-pages/:id/unpublish
  • POST /api/v1/bio-pages/:id/items
  • PUT /api/v1/bio-pages/:id/items/order
  • PATCH /api/v1/bio-pages/:id/items/:itemId
  • DELETE /api/v1/bio-pages/:id/items/:itemId
  • POST /api/v1/bio-pages/:id/avatar — multipart upload
  • DELETE /api/v1/bio-pages/:id/avatar
  • POST /api/v1/bio-pages/:id/items/:itemId/thumbnail — multipart upload
  • DELETE /api/v1/bio-pages/:id/items/:itemId/thumbnail
  • GET /api/v1/bio-pages/:id/subscribers — JSON or CSV
  • DELETE /api/v1/bio-pages/:id/subscribers/:subscriberId
  • GET /api/v1/bio-pages/:id/analytics — views and per-item clicks

Billing (Sumit) — /api/v1/billing · Billing​

  • GET /api/v1/billing/plans
  • GET /api/v1/billing/subscription
  • POST /api/v1/billing/checkout
  • POST /api/v1/billing/confirm
  • POST /api/v1/billing/cancel
  • POST /api/v1/billing/resume
  • GET /api/v1/billing/invoices
  • POST /api/v1/billing/sumit-webhook

Public — root & /api/v1/public​

  • GET /:shortCode — redirect + click tracking (Links, Smart routing)
  • POST /:shortCode/verify — password-protected links
  • GET /:shortCode/info — link preview — not implemented, returns 404
  • GET /:shortCode/qr — QR codes
  • GET /api/v1/public/bio/:slug — Link-in-bio
  • POST /api/v1/public/bio/:slug/items/:itemId/click
  • GET /api/v1/public/analytics/:token — Shareable analytics
  • POST /api/v1/public/bio/:slug/view
  • POST /api/v1/public/bio/:slug/subscribe — email capture
  • GET /api/v1/public/media/* — uploaded bio avatars and thumbnails
  • POST /api/v1/public/report/:shortCode — report abuse

QR codes · QR codes​

  • GET /:shortCode/qr — public image, also listed above
  • POST /api/v1/qr/bulk — many short codes in one call

Webhook events · Webhooks​

  • link.created
  • link.updated
  • link.deleted
  • link.clicked
  • link.expired — reserved: accepted in a subscription, never sent yet
  • link.limit_reached — reserved: accepted in a subscription, never sent yet
  • domain.verified
  • domain.ssl_ready — reserved: accepted in a subscription, never sent yet
  • subscription.upgraded
  • subscription.cancelled