---
title: API reference
description: Headers, auth, and the HTTP surface used by both SDKs.
---

# API reference

Base URL: `YOUR_API_URL`

All JSON. Typical envelope: `{ "data": ... }` or `{ "error": "code", "message": "..." }`.

## Headers

| Header | When |
| --- | --- |
| `Content-Type: application/json` | body requests |
| `X-Application-Code: YOUR_APP_CODE` | identify app |
| `X-Application-Id: <uuid>` | alternative to code |
| `X-Public-Key: rb_pub_…` | paywall + payments (required where noted) |
| `Authorization: Bearer <jwt>` | user-scoped routes |

## Public

### Get paywall

```http
GET /v1/applications/{app_code}/paywalls/{paywall_code}
X-Public-Key: YOUR_PUBLIC_KEY
```

### Remote config

```http
GET /v1/applications/{app_code}/config?platform=web&app_version=1.0.0
```

## Authenticated (end user)

### Register user

```http
POST /v1/applications/{app_code}/users/register
Authorization: Bearer YOUR_ACCESS_TOKEN
```

### Entitlements

```http
GET /v1/applications/{app_code}/entitlements/me
Authorization: Bearer YOUR_ACCESS_TOKEN
```

### Create payment

```http
POST /v1/payments
Authorization: Bearer YOUR_ACCESS_TOKEN
X-Public-Key: YOUR_PUBLIC_KEY

{
  "application_code": "YOUR_APP_CODE",
  "plan_price_id": "uuid",
  "return_url": "https://your.app/return"
}
```

Paid only. Free prices → `400 free_plan_offline`.

### License key

```http
POST /v1/applications/{app_code}/license-keys/activate
Authorization: Bearer YOUR_ACCESS_TOKEN

{ "key": "RB-....", "installation_id": "optional" }
```

### Devices

```http
POST /v1/devices/register
GET  /v1/devices?application_code=YOUR_APP_CODE
DELETE /v1/devices/{device_id}
```

### Features

```http
GET /v1/applications/{app_code}/features?platform=android&app_version=1.0.0
```

### Events

```http
POST /v1/events
POST /v1/events/batch
```

## Webhooks (server)

Payment provider webhooks hit the Platform API (not the marketing site). Configure the provider URL to the Platform payments webhook path provided in your deployment docs. Never put provider secrets in the client SDK.