Public API

ENDURE offers a public API with 16 v1 endpoints + 2 api-key management routes (using Clerk auth) for external integrations and automation. The v1 endpoints are under /api/v1/ with API key authentication.

Authentication

All API requests require an API key in the Authorization header:

Authorization: Bearer endure_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Create API keys from Settings > API Keys. Keys have:

• Scope: read (GET requests only) or write (all HTTP methods)
• Optional expiration: Set a date after which the key stops working
• Revocation: Disable a key permanently at any time
• Maximum: 5 active keys per user

The full key is shown once at creation. Only a SHA-256 hash is stored — if you lose the key, you'll need to create a new one. Keys use the format endure_live_ followed by 32 hex characters.

Rate Limits

Limits depend on account state:

Rate limit headers are included in every response:

• X-RateLimit-Limit — Your limit
• X-RateLimit-Remaining — Requests remaining
• X-RateLimit-Reset — When the limit resets (Unix timestamp in milliseconds)
• Retry-After — Seconds to wait if rate limited (HTTP 429)

Endpoints

API Key Management (uses Clerk auth, not API keys):

Response Format

All successful responses follow this envelope:

{
  "data": { ... },
  "meta": {
    "request_id": "uuid",
    "timestamp": "2026-02-22T12:00:00.000Z"
  }
}

Error responses:

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Invalid or revoked API key.",
    "details": []
  },
  "meta": {
    "request_id": "uuid",
    "timestamp": "2026-02-22T12:00:00.000Z"
  }
}

Error codes: UNAUTHORIZED (401), FORBIDDEN (403), NOT_FOUND (404), VALIDATION_ERROR (400), RATE_LIMITED (429), SCOPE_INSUFFICIENT (403), INTERNAL_ERROR (500), SERVICE_UNAVAILABLE (503: the API key could not be checked right now; it is not a rejection, so retry after the Retry-After seconds instead of treating the key as invalid).

Pagination

List endpoints use cursor-based pagination. The response includes:

{
  "pagination": {
    "has_more": true,
    "cursor": "eyJkYXRlIjoiMjAyNi0wMS0xNSIsImlkIjoiYWJjMTIzIn0=",
    "limit": 50
  }
}

Pass the cursor as a query parameter to get the next page: ?cursor=eyJkYXRlIjoi...

Default page size is 50, maximum is 200.

PII Stripping

The API never returns sensitive fields: clerk_id, email, user_id, access_token, refresh_token, or any stripe_* fields are stripped from all responses.

CORS

The API supports cross-origin requests with Access-Control-Allow-Origin: *. All endpoints include an OPTIONS handler for preflight requests.

Status Endpoint

The /api/v1/status endpoint is the only public endpoint (no auth required). It returns:

{
  "data": {
    "status": "operational",
    "version": "1.0.0",
    "database": "healthy"
  }
}

Use this for uptime monitoring and health checks.

---