The Paylood API is a REST API built with NestJS. It is prefixed with /api/v1.
Base URL
https://<your-instance>/api/v1Interactive documentation (Swagger)
The OpenAPI documentation is available at:
https://<your-instance>/api/docsWarning
Swagger is only enabled in non-production environments by default, for security reasons. In production it may be disabled.
Authentication
The API uses JWT Bearer tokens:
Authorization: Bearer <your-token>Get a token through the login endpoint:
curl -X POST https://app.paylood.com/api/v1/auth/login \
-H "Content-Type: application/json" \
-d '{"email":"you@example.com","password":"password"}'The response contains accessToken and the user profile.
Main endpoints
Auth
| Method | Endpoint | Description |
|---|---|---|
| POST | /auth/register | Create an account |
| POST | /auth/login | Sign in |
| POST | /auth/verify-otp | Validate the OTP code |
| POST | /auth/forgot-password | Request a reset link |
| POST | /auth/reset-password | Reset the password |
Git Providers
| Method | Endpoint | Description |
|---|---|---|
| POST | /git-provider/save-token | Save a Git token |
| GET | /git-providers | List connected accounts |
| GET | /git-providers/repositories | Search repositories |
| GET | /git-providers/:providerId/repos/:repo/branches | Repository branches |
| DELETE | /git-providers/:id | Disconnect an account |
Projects & Environments
| Method | Endpoint | Description |
|---|---|---|
| POST | /projects | Create a project |
| GET | /projects | List projects |
| GET | /projects/:id | Project details |
| PUT | /projects/:id | Update a project |
| DELETE | /projects/:id | Delete a project |
| GET | /projects/analyze-repo | Analyze a repository |
| POST | /projects/:id/finalize | Finalize (optionally deploy) |
| POST | /projects/:id/retry-analysis | Rerun the analysis |
Environments
| Method | Endpoint | Description |
|---|---|---|
| POST | /environments | Create an environment |
| PATCH | /environments/:id | Update an environment |
| PATCH | /environments/:id/branch | Change the branch |
| PATCH | /environments/:id/server | Link a server |
| DELETE | /environments/:id | Delete an environment |
| PATCH | /environments/:id/auto-deploy | Toggle auto-deploy |
| POST | /environments/:id/services | Configure services |
| POST | /environments/:id/domain | Configure domain + SSL |
| POST | /environments/:id/variables | Add variables |
| GET | /environments/:id/deployments | Deployment history |
| POST | /environments/:id/deployments/:did/cancel | Cancel a deployment |
Servers
| Method | Endpoint | Description |
|---|---|---|
| POST | /servers | Add a server |
| GET | /servers | List servers |
| GET | /servers/:id/security | Security state |
| POST | /servers/:id/security/harden | Harden the server |
| DELETE | /servers/:id | Delete a server |
Domains
| Method | Endpoint | Description |
|---|---|---|
| POST | /domains | Register a domain |
| GET | /domains | List domains |
| POST | /domains/:id/verify | Verify a domain |
| DELETE | /domains/:id | Delete a domain |
Backups
| Method | Endpoint | Description |
|---|---|---|
| GET | /environments/:id/backups | List backups |
| POST | /environments/:id/backups/trigger | Trigger a backup |
| POST | /environments/:id/backups/:bid/restore | Restore |
| POST | /environments/:id/backups/import | Import a SQL file |
| PATCH | /environments/:id/backups/config | Configure scheduling |
Notifications
| Method | Endpoint | Description |
|---|---|---|
| GET | /notification-connectors | List connectors |
| POST | /notification-connectors | Create a connector |
| POST | /notification-connectors/:id/test | Test a connector |
| PUT | /notification-connectors/project/:projectId | Link to a project |
| DELETE | /notification-connectors/:id | Delete a connector |
Real-time streams (SSE)
Some endpoints stream events via Server-Sent Events:
GET /events— global events (project_updated).GET /environments/:id/deployments/:did/status— deployment status.GET /projects/:id/analysis-status— analysis status.POST /servers/test-connection— SSH connection test.
const sse = new EventSource('/api/v1/events');
sse.onmessage = (e) => console.log(e.data);Rate limits
The API is protected by a throttler. Requests over the limit return 429.
The list above is an overview. The exhaustive reference (schemas, parameters, models) is in Swagger at /api/docs.