API reference — overview
EmitWave has two HTTP surfaces: a signed publish endpoint for realtime, and a management API for organizations, applications, and credentials.
API· 4 min read
Two API surfaces
EmitWave exposes two HTTP surfaces with different roles and credentials:
- Publish endpoint — accepts HMAC-signed publishes at
/apps/{appId}/events. Authenticated with a server credential. See Publish event. - Management API —
/api/platform/*: organizations, applications, credentials, webhooks, and realtime auth. Authenticated with bearer tokens and organization RBAC.
Base URLs
| Surface | Production base |
|---|---|
| Gateway publish | https://api.emitwave.com/apps/{appId}/events |
| Realtime auth | https://api.emitwave.com/api/platform/emitwave/* |
| Management | https://api.emitwave.com/api/platform/* |
| WebSocket | wss://api.emitwave.com/app/connection/websocket |
Publish endpoint
| Method | Path | Purpose |
|---|---|---|
| POST | /apps/{appId}/events | Publish a signed event — docs |
Management endpoints
| Group | Base path | Reference |
|---|---|---|
| Auth | /api/platform/auth/token | Authentication |
| Realtime auth | /api/platform/emitwave/* | Realtime auth |
| Applications | /api/platform/applications/* | Applications |
| Credentials | …/applications/{id}/credentials | Credentials |
| Webhooks | …/applications/{id}/webhooks | Webhooks |
All
/api/platform/* routes except auth/token require a bearer token. Credential and webhook sub-resources are scope-bound to their parent application, so an ID from another app returns 404 rather than leaking across tenants.