API overview
Use Orbitr's authenticated JSON API for supported first-party workflows and keep task creation under Strategy authority.
Base URL
https://api.getorbitr.com/api/v1Liveness and readiness are separate:
GET https://api.getorbitr.com/live
GET https://api.getorbitr.com/readyAuthentication
Authenticated application requests use the access token returned by the Orbitr auth flow:
Authorization: Bearer ACCESS_TOKEN
Content-Type: application/jsonDo not place tokens in URLs, client logs, or source control. Refresh and logout behavior is managed through the authentication endpoints used by the Orbitr app.
Supported endpoint families
The production API includes authenticated endpoint families for:
| Resource | Examples |
|---|---|
| Account | POST /auth/login, POST /auth/refresh, GET /auth/me |
| Sites | GET /sites, GET /sites/{site_id}, GET /sites/{site_id}/progress |
| Audits | POST /audits, GET /audits/site/{site_id}/latest |
| Tasks | GET /tasks, GET /tasks/awaiting-approval, POST /tasks/{task_id}/approve |
| Verification | GET /verification/tasks/{task_id}/verification-status |
| Rollback | POST /tasks/{task_id}/rollback, GET /cms/rollback/history |
GET /integrations/google/search-console/properties |
Task creation boundary
Customer-facing tasks are created by the Strategy Agent. The presence of an internal task endpoint is not a supported contract for bypassing Strategy, evidence, quality gates, or approval.
Responses and errors
Successful responses are JSON. Validation errors use HTTP 422; missing authentication uses 401; insufficient site or resource access uses 403 or 404; rate limits use 429.
The API validates JSON content types strictly. Send JSON request bodies with Content-Type: application/json.
Stability
Use only endpoints exposed by the Orbitr product or explicitly enabled for your account. Internal and admin endpoints are not a public integration contract and may change without public deprecation guarantees.