Skip to content

REST API

Reloqui exposes a versioned REST API under /api/v1. A live, interactive OpenAPI explorer is available at reloqui.com/api/v1/docs.

Two ways to authenticate:

  • User JWTAuthorization: Bearer <accessToken> from POST /api/v1/auth/login, plus an X-Org-Id header for org-scoped calls. Access tokens refresh via rotating refresh tokens.
  • Service tokenAuthorization: Bearer rat_… for automation, scoped (see Roles).
  • Base path — every route is under /api/v1.
  • Pagination — list endpoints return { "data": [...], "pagination": { "nextCursor", "hasMore", "pageSize" } }; growth collections use cursor paging.
  • Status codes201 + Location on creation, 202 for async-shaped ops, 204 for deletes.
  • Errors{ "error": { "code", "message", "details", "traceId" } } with SCREAMING_SNAKE codes; X-Request-ID echoes the trace id.
  • Rate limits — per-IP fixed window: strict on credential endpoints (login/register/refresh), general elsewhere. The public demo entry (/auth/demo) uses the general limit so shared/NAT IPs aren’t locked out.
  • Idempotency — webhook and replay paths dedup on stable keys.
POST /api/v1/auth/login
GET /api/v1/releases?projectId=…
POST /api/v1/releases
POST /api/v1/releases/{id}/reconcile
GET /api/v1/releases/{id}/360
GET /api/v1/releases/{id}/notes?audience=engineering
POST /api/v1/releases/{id}/publish
GET /api/v1/services/{id}/lineage
POST /api/v1/actions/{actionId}/run
GET /api/v1/audit/events

POST /api/v1/auth/demo issues read-only tokens for the shared Nimbus Commerce demo org — the same tokens the live demo uses.