APIOverview
Overview
Same binary, two credentials. Default base: http://localhost:8080 (EPURE_PUBLIC_URL if you changed the port). Health (no auth): GET /health → { "status": "ok" }.
How is the HTTP API split?
Ingest uses a DSN; Issues and Events use a session cookie. Ingest success is 202 Accepted with { "id": "<uuid>" }.
| Object | Auth | Job |
|---|---|---|
| Ingest | DSN | Envelope, store, release files, user feedback |
| Issues | Session | List, patch, merge, snooze, bulk |
| Events | Session | Occurrences, timeline, crash-dialog feedback |
| Authentication | reference | DSN, session, and PAT |
| Webhooks | Session | Slack, Discord, generic HTTPS |
| Agent | PAT (epure_pat_…) | Queue, context, triage for automation |
| Errors | reference | Codes and what to do next |
Body limit is 2 MB. DSN headers on /api/v1/* return 401; a session cookie on envelope or store does nothing.
Surfaces
OpenAPI specs in the product repo: ingest.openapi.yaml · agent.openapi.yaml. SDK versions: SDK matrix.
FAQ
Is a DSN the same as a session cookie?
No. The DSN authenticates ingest (`/envelope/`, `/store/`, release files, user feedback). Issues, Events, and other `/api/v1/*` routes need a login cookie. Agent automation uses a separate PAT on `/api/v1/agent/*`. DSN headers on dashboard APIs return **401**. Full table: [Authentication](/docs/api/authentication).
What does HTTP 202 mean on ingest?
**202 Accepted** means the DSN and body passed the gate. Persist and JS/TS demangle run on a Tokio queue after the response. A 202 can still yield an empty Issues list when the environment filter is wrong. See [Verify](/docs/get-started/verify).
What is the 2 MB cap and the spike valve?
Ingest bodies over **2 MB** return **413** `payload_too_large`. The spike valve is about **100** raw events per minute per fingerprint; saturated fingerprints still get **202** and a counter bump. The hourly project cap (default **5000**) returns **403**. See [API errors](/docs/api/errors).