Forumulate API

Embed
Preview of the card
<a href="https://forumulate.com/reference/forumulate-api"><img src="https://forumulate.com/reference/_api/public/orgs/046a9bc0-d530-43ae-9bae-af7945008cda/spaces/8042f004-e3d9-445f-b7a4-b6c1f86836e6/pages/30b9c665-bbcb-44cd-8234-19360dc9537d/social-card.svg?v=3e7ae33eec8b" alt="Forumulate API" width="600" height="315"></a>

The full Forumulate REST API — identity, organizations, spaces, docs authoring, publishing, search, AI, webhooks, and the public reader. Authenticate with a Personal Access Token (Bearer) or the session cookie. Download this spec at `/openapi.json` to generate a client SDK (e.g. with openapi-generator). **Set a non-default `User-Agent` on every request.** The edge WAF challenges requests that carry a default `curl`/library User-Agent (you get a Cloudflare 1010 block, not a JSON error), so a first-time integration silently fails until a custom UA is set — any identifying string (e.g. `my-app-integration/1.0`) passes. ## Conventions **Organizations take an id or a slug.** `/orgs/{orgId}/…` accepts either the uuid or the name in `slug`. A name that is not yours is a 404, never a 500. **A collection is keyed after its path.** `/spaces` answers `{ spaces }`, `/webhooks` answers `{ webhooks }`, `/orgs` answers `{ orgs }` — and `{ organizations }` too, which is what it has always answered. **State your version and you get the envelope.** Send `Forumulate-Version: 2026-09-01` and every collection carries `page` (`limit`, `has_more`, `next_cursor`, `total`); walks also carry `sync.checkpoint`. Send nothing and you get the pre-envelope shape, plus `Deprecation` and `Sunset` headers saying so. **Rate limits are per minute.** Every response carries `RateLimit-Limit`, `RateLimit-Policy` (`600;w=60` — the limit and the window in seconds), `RateLimit-Remaining` and `RateLimit-Reset`. A 429 also carries `Retry-After`. **Removals are discoverable for 30 days.** `include_deleted=true` carries tombstones, so an incremental sync never has to fall back to a full list to learn what went away. **Slots carry roles, and the vocabulary is published.** `GET /roles` returns the controlled list, each role's canonical reading position and a gloss, plus what an unroled slot does. It is versioned: a new role is a version bump, not a silent change to how your articles order themselves. **Chunks are ours to split.** `GET /orgs/{orgId}/spaces/{spaceId}/items/{itemId}/chunks` returns retrieval-grade chunks with a per-chunk `contentHash`, so you re-embed what changed rather than everything. The split is a contract once you store a `chunkId`: `policy.version` changing is a breaking change. **Webhook deliveries** are signed `X-Forumulate-Signature: v1,sha256=<hex>` over `${timestamp}.${rawBody}`, with `X-Forumulate-Timestamp`, `X-Forumulate-Event` and `X-Forumulate-Delivery` (the key to dedupe on). `GET /orgs/{orgId}/webhooks/events` says which event means which change.

Servers

URL

Description

https://forumulate.com/api

Production

Authentication

This API authenticates with: Bearer token (Authorization: Bearer <token>); API key (cookie "forumulate_session").

Reference

The Forumulate teamUpdated