Orbitr field guide
API overview
Use Orbitr's authenticated JSON API for supported first-party workflows and keep task creation under Strategy authority.
Base URL
https://api.getorbitr.com/api/v1Liveness and readiness are separate:
GET https://api.getorbitr.com/live
GET https://api.getorbitr.com/readyAuthentication
Authenticated application requests use the access token returned by the Orbitr auth flow:
Authorization: Bearer ACCESS_TOKEN
Content-Type: application/jsonDo not place tokens in URLs, client logs, or source control. Refresh and logout behavior is managed through the authentication endpoints used by the Orbitr app.
Supported endpoint families
The production API currently includes authenticated endpoint families used by the Orbitr app:
| Resource | Examples |
|---|---|
| Account | POST /auth/login, POST /auth/refresh, GET /auth/me |
| Sites | GET /sites, GET /sites/{site_id}, GET /sites/{site_id}/progress |
| Audits | POST /audits, GET /audits/site/{site_id}/latest |
| Tasks | GET /tasks, GET /tasks/awaiting-approval, POST /tasks/{task_id}/approve |
| Verification | GET /verification/tasks/{task_id}/verification-status |
| CMS rollback | POST /cms/rollback/{operation_id}, GET /cms/rollback/history?site_id={site_id} |
GET /integrations/google/search-console/properties |
Paths in this table are relative to the base URL. Except for liveness and readiness, treat these as authenticated application endpoints rather than anonymous public APIs.
Task creation boundary
Customer-facing tasks are created by the Strategy Agent. The presence of an internal task endpoint is not a supported contract for bypassing Strategy, evidence, quality gates, or approval.
Responses and errors
Successful responses are JSON. Validation errors commonly use HTTP 422; missing authentication uses 401; insufficient site or resource access uses 403 or 404; rate limits use 429.
The API validates JSON content types strictly. Send JSON request bodies with Content-Type: application/json.
Health and runtime identity
/live reports process liveness. /ready checks required database and Redis dependencies and can return 503. A 200 from /live does not prove the service is ready to handle application traffic.
Detailed runtime identity is available through the protected operator endpoint at /version; it is not an anonymous health endpoint.
Stability
Use only endpoints exposed by the Orbitr product or explicitly enabled for your account. Internal and admin endpoints are not a public integration contract and may change without public deprecation guarantees.