REST API

Everything the dashboard does with links can be done over the API. The base path is /api/v1 on the dashboard’s host.

• Reference: signed in, open Developers in the dashboard. It lists every endpoint with a curl example filled in with your own project.
• OpenAPI document: /api/v1/openapi.json, generated from the same definitions as the reference, for client generators and tools.

Authentication

Create a secret key under API keys in a project. It is shown once. Send it as a bearer token:

curl "https://portal.dl2.app/api/v1/projects" \
  -H "Authorization: Bearer sk_live_…"

Keys carry scopes, so a key can be limited to reading. Publishable keys (pk_live_…) are for the SDKs only and are refused by the REST API.

Conventions

• Idempotency: send an Idempotency-Key header on POST requests. A repeat with the same key within 24 hours returns the first response instead of acting twice.
• Rate limits: per key, reported in RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset headers. A 429 carries Retry-After.
• Errors are JSON with a stable code and a message written for people.
• Read-only teams: when a team is in survival mode, reads keep working and writes are refused.
• Link checks apply: a link created through the API goes through the same destination scan and new-account limits as one created in the dashboard.

The SDK endpoints

The SDKs talk to three endpoints on api.dl2.app, authenticated with the publishable key in an X-DL2-Key header: /v1/sdk/open (first launch and deferred matching), /v1/sdk/resolve (what a link means) and /v1/sdk/event (in-app events). You normally never call them yourself.

For AI assistants and scripts

The same operations are available to AI assistants through the MCP server and from a terminal through the command-line tool. The docs are also published as plain text at /llms.txt.