Base URL
All API endpoints are served from:Making requests
Every request must include theContent-Type: application/json header (except multipart file uploads, which use multipart/form-data). Use the HTTP method specified for each endpoint — GET for reads, POST for creates and actions, and DELETE where supported.
The PartnerOS API uses session-based authentication via a browser cookie. See the Authentication page for how to obtain a session token and pass it with API requests.
Request and response format
Request bodies must be valid JSON. Responses are always JSON objects. Successful responses include the relevant resource data at the top level (for example,{ "partner": { ... } } or { "success": true }).
Timestamps use ISO 8601 format (2026-05-16T12:00:00.000Z). UUIDs are lowercase with hyphens.
Error format
When a request fails, the API returns a JSON object with anerror string and, for some errors, a code field with a machine-readable identifier.
HTTP status codes
Rate limiting
The API enforces per-organization, per-user rate limits that vary by endpoint. File upload endpoints (such as partner application banner uploads) allow up to 20 requests per minute per user. AI generation endpoints are subject to your plan’s quota. When you exceed a limit the API returns429 Too Many Requests.