# API reference

> Part of the Cowliss docs. Markdown for every page: append `index.md` to its URL. Site map: /llms.txt

These pages are **generated, not hand-written**: they come from the same zod schemas the API validates every request and response with, so they cannot drift from the running API.

- The machine-readable document: [`/openapi.json`](/openapi.json)
- The rules every endpoint follows: [API conventions](/api-conventions/) (envelopes, error codes, pagination, auth, idempotency).

Two credentials, two subtrees, never crossing: ingestion (`identify`, `track`, `batch`) takes an org API key, everything else a session token, with destructive actions gated to `org:admin`. Public webhooks (delivery feedback, one-click unsubscribe, payments) verify their own signatures and answer per the caller's convention.

The sidebar lists every section: ingestion, users, events, apps, sources, segments, automations, webhooks, domains, deliveries, suppressions, settings, billing, health.