API overview — Voidhash Docs

The base URL, request conventions, and endpoint groups of the Voidhash HTTP API.

The Voidhash HTTP API is for server integrations and custom tooling. Use it when you need to read or change project data from your own backend or scripts. Mobile apps should use one of the mobile SDKs instead. The SDKs handle device headers, identity, caching, and store transactions for you.

Base URL

All requests go to the same host:

https://api.voidhash.com

Management endpoints live under /api/v1. Analytics ingestion uses a separate surface under /i/v1.

First request

Create a project secret key in Studio. Then call the session endpoint to confirm the key works and see what it resolves to:

curl https://api.voidhash.com/api/v1/auth/session \
  -H "x-secret-key: $VOIDHASH_SECRET_KEY"

Keep secret keys on the server. See Authentication for every credential type and where each one belongs.

Endpoint groups

The API is organized into the following groups.

Group	Use
API keys	Create and rotate project credentials.
Persons	Create and look up customer records.
Products and perks	Read the project catalog and product-to-perk relationships.
Paywall locations	Read the locations available to clients.
Schema	Fetch the consolidated project schema and version.
Webhooks	Manage endpoints, inspect deliveries, rotate secrets, and retry events.
Paywall deploys	Upload and finalize code-authored paywalls.
SDK	Device-facing endpoints used by official SDKs.

The generated endpoint pages contain request schemas, response schemas, and an interactive client for each group.

Errors

Management API errors are JSON objects with a stable _tag field that identifies the error type:

{
  "_tag": "Api/NotAuthenticatedError",
  "message": "You are not authenticated"
}

Use the HTTP status for the broad outcome and _tag for application behavior. Do not parse the human-readable message. It can change without notice.

Status	Meaning
`400`	Invalid request or parameters.
`401`	Missing or invalid credentials.
`403`	Credential does not permit the action.
`404`	Resource not found.
`409`	Request conflicts with current state.
`429`	Rate limited. Retry after the indicated delay.
`5xx`	Server failure. Retry safe requests with backoff.

OpenAPI

Machine-readable specifications are available for both API surfaces. Fetch GET /api/docs/openapi.json for the management and SDK API, and GET /i/docs/openapi.json for event capture.