API reference

The reference pages in this section are generated, not hand-written: a script converts the zod schemas in packages/shared — the same ones the API parses requests and serializes responses with — into an OpenAPI 3.1 document and renders these pages from it. When a contract changes, regeneration changes the docs.

• The machine-readable document: /openapi.json
• The rules every endpoint follows: API conventions (envelopes, error codes, pagination, auth, idempotency).
• Regenerate locally: pnpm -F cowliss-docs generate.

Two credential types guard two subtrees, and never cross: ingestion (identify, track, batch) takes an org-scoped Clerk API key; everything else takes a Clerk session token, with destructive actions gated to org:admin. Public webhooks (SES feedback via SNS, one-click unsubscribe, Stripe) verify their own signatures and answer per the caller’s convention.

The sidebar lists every section: ingestion, users, events, apps, sources, catalog, violations, segments, journeys, destinations, domains, deliveries, suppressions, settings, billing, health.