API Overview

Apex exposes a REST API for tracking events, managing experiments, resolving identities, and querying analytics. All endpoints are relative to your Apex host.

Base URL

https://app.apex.inc

For local development, use http://localhost:3000. Staging is https://staging.app.apex.inc.

Authentication

Apex supports two authentication methods depending on context.

Dashboard requests use the signed-in browser session. That is set automatically after sign-in.

API key

For server-to-server or SDK calls, pass a workspace or org key:

curl -H "x-api-key: apex_sk_..." https://app.apex.inc/api/v1/events

Or using the Authorization header:

curl -H "Authorization: Bearer apex_sk_..." https://app.apex.inc/api/v1/events

Keys:

Prefix	Use
`apex_sk_`	Org / server key. CI, webhooks, Server Events.
`apex_uk_`	Personal user key. MCP and "act as me" tools.

Info

Public endpoints — /api/events (the snippet), /api/experiments/active, and /api/apex-js — do not require a key. Server-side truth events use POST /api/v1/events with apex_sk_.

Error format

All error responses follow a consistent JSON structure:

{
  "error": "Human-readable error message",
  "code": "VALIDATION_ERROR",
  "status": 400
}

Common status codes:

Status	Meaning
`400`	Bad request — missing or invalid parameters
`401`	Unauthorized — missing or invalid credentials
`403`	Forbidden — valid credentials but insufficient permissions
`404`	Resource not found
`429`	Rate limit exceeded
`500`	Internal server error

Rate limiting

API-key traffic is limited per key. When you exceed the limit, the API returns 429 Too Many Requests with a Retry-After header.

Limits are per second and depend on the key. Do not bake a requests-per-minute table into a client. Batch events so one request carries many events.

Tip

Batch events using the SDK payload format. A single batch request counts as one request regardless of how many events it contains.

Content type

All request and response bodies use application/json. Set the Content-Type header on POST, PATCH, and DELETE requests.

Next steps

Server Events — the authenticated backend path
Events API — what the snippet posts
Experiments API — create and manage experiments
Identity API — stitch anonymous visitors to known customers
Segments API — who a journey or letter is for