# Public API

Source: https://docs.fortrabbit.com/platform/automation/api
Reviewed: 2026-08-14


::CallOut{alert}
This article is a draft and the API itself is in beta. Both the endpoints and this page will keep changing. API tokens cannot be created in the production dashboard yet.
::

## About the public API

The API covers the objects the dashboard works with: apps, environments, deployments, domains, teams, people and payment methods. It speaks JSON over HTTPS and is versioned in the URL.

## API reference docs

The full endpoint reference is generated from the API itself and lives at:

- [api.fortrabbit.com/v1/docs](https://api.fortrabbit.com/v1/docs)

## Entry point

All endpoints sit under a single base URL:



```
https://api.fortrabbit.com/v1
```

Send `Accept: application/json` on every request. Without it the API answers in JSON-LD, which carries extra `@`-prefixed metadata most clients do not expect.

## Authentication

The API authenticates with a personal API token, created in the dashboard from the account menu under `API tokens`. The full token is shown once, right after creation, and cannot be retrieved later — store it before leaving the page. The listing afterwards shows only the last four characters.

Pass the token as a bearer token on every request:



```shell
curl https://api.fortrabbit.com/v1/apps \
  -H "Authorization: Bearer frbit-at-YOUR-TOKEN" \
  -H "Accept: application/json"
```

A token acts as the person who created it and sees exactly what that person sees in the dashboard — no more. Revoking a token in the dashboard takes effect immediately.

## What the API covers

| Resource        | Path                                                   |
| --------------- | ------------------------------------------------------ |
| Apps            | `/v1/apps`                                             |
| Environments    | `/v1/environments`                                     |
| Deployments     | `/v1/deployments`, `/v1/environments/{id}/deployments` |
| Domains         | `/v1/domains`                                          |
| Teams           | `/v1/teams`                                            |
| People          | `/v1/people`                                           |
| Payment methods | `/v1/payment-methods`                                  |

Objects are addressed by their public ID — the same short `ap-`, `en-`, `do-` identifiers the dashboard shows. Collections accept a repeated `publicId[]` parameter to fetch several known objects in one call.

## Rate limits

Requests are counted per token in a sliding window of one minute, currently at around 20 per minute. Every response carries `X-RateLimit-Limit`, `X-RateLimit-Remaining` and `X-RateLimit-Reset`; a rejected request answers `429` and adds `Retry-After` with the seconds to wait.

Failed authentications are counted separately, per IP address. Retrying a rejected credential in a loop locks the address out rather than the token.

## Stability

The API is in beta, like the platform itself. Breaking changes are possible while that lasts, so pin nothing that cannot be adjusted. The `/v1` prefix marks the shape of the API, not a frozen contract.

---

- [CLI](/platform/automation/cli)
- [MCP server](/platform/automation/mcp)