API Reference

The Apptonomy REST API is the backend that powers the Apptonomy web app and Figma plugin. It runs on Cloudflare Workers using the Hono framework.

Not a public developer API yet

This API exists to serve Apptonomy’s own first-party apps. It is not currently offered as a supported, stable public API: there is no API-key issuance, no versioning guarantee, and endpoints can change without notice. This page documents its shape for reference, not as an integration contract. If you need programmatic access, contact support@apptonomy.ai so we can understand the use case.

Base URL

https://api.apptonomy.ai

Authentication

Requests are authenticated with a Clerk session token — the same short-lived token the signed-in web app holds — passed as a Bearer token:

curl -H "Authorization: Bearer <clerk-session-token>" \
  https://api.apptonomy.ai/apptonomy/project

There are no long-lived personal API keys. Some surfaces use their own scheme instead of a session token: the Figma plugin authenticates with a plugin token, public token-based pages (email preferences, unsubscribe) carry a signed token in the request, and inbound webhooks are verified by per-provider signatures.

Path structure

Most endpoints are product-scoped under a product id, which is apptonomy:

/{productId}/{resource}

The main product-scoped resource groups:

Group	Path base	What it covers
Project	/apptonomy/project	Projects, listings, audits, competitors
User	/apptonomy/user	The signed-in user and preferences
Org	/apptonomy/org	Organizations, members, integrations
ASO	/apptonomy/aso	Audit runs and ASO analysis
Billing	/apptonomy/billing	Subscriptions and entitlements
Payment	/apptonomy/payment	Checkout and payment flows
Support	/apptonomy/support	Support requests
Plugin	/apptonomy/plugin	Figma plugin endpoints
AppCheck	/apptonomy/appcheck	Public lead-capture audit
Affiliate	/apptonomy/affiliate	Affiliate tracking, signup, and portal

A handful of endpoints sit at the root (not product-scoped) because they need no product context: /health, /cdn (public string serving), /release-notes, /email-preferences and /unsubscribe (token-based), messaging under /messaging, and /admin (its own authentication).

Webhooks

Apptonomy’s webhook endpoints are inbound — they receive events from external services (Stripe, Clerk, Slack, Linear, Resend) and from OAuth callbacks. Each verifies the sender’s signature. Apptonomy does not currently send outbound webhooks to customer endpoints; audit and publish status are surfaced in the app and by email, not by an outgoing webhook.

How this is sourced

This reference is derived from the API’s route definitions. Because the API backs Apptonomy’s own apps and is not a published integration surface, paths, groups, and auth can change between releases without a compatibility guarantee.