Product · · 7 min read
The Mobieus API: Your Community, Wired Into Everything Else You Run
Owning your community is the headline pitch. But ownership only means something if you can connect what you own to the rest of your stack. Piping new posts into a Slack channel, firing a welcome series the moment someone signs up, mirroring moderator decisions to an internal incident log, dropping last week's posts into a BI tool. None of that is glamorous work, and skipping it leaves your community sitting in a silo, walled off from every other system you depend on. The Mobieus API exists to tear that wall down, and over the past few weeks it has grown from a read-only window into a full, write-capable surface that covers nearly the entire platform.
Here's what that actually gives you, and how it stacks up against the platforms that treat API access as either an afterthought or an upsell.
A real API, documented as a contract
The Mobieus API ships with an OpenAPI 3.1 specification that serves as the single source of truth, rendered as interactive documentation through Redoc at /api/docs. Hand that URL to a contractor, an internal team, or an AI agent, and they have a precise contract to build against rather than a pile of guesswork. You can pull the raw spec at /api/openapi.yaml and scaffold a typed client in whatever language you work in.
That matters more than it sounds. Plenty of community platforms expose a handful of endpoints and call it a day, leaving developers to reverse-engineer behavior from trial and error. A published, versioned spec is the difference between integration being a copy-from-the-docs job and a multi-week investigation.
Security that assumes someone is trying
API keys are shown once, then stored as a SHA-256 hash and compared in constant time on lookup. Each key carries an environment (live or test) and a scope set that's granular per resource, so a key you hand a sandbox script literally cannot create posts in production. Every request records a last-used timestamp and IP, which means a dormant key stands out before it turns into a liability.
Webhooks are built with the same posture. Each delivery carries a Mobieus-Signature header that's an HMAC-SHA256 of the timestamp and raw body, so your receiver can confirm the payload came from Mobieus and isn't a replay of an old one, with a five-minute timestamp tolerance. Failed deliveries retry on an escalating schedule out to 24 hours, and an endpoint that keeps failing is auto-disabled and flagged in the dashboard. Every attempt is logged with status code, latency, and the first 2KB of the response body, so debugging is a single click into the webhook's page instead of a hunt through your own logs. Rotating a signing secret keeps the old one valid for a grace window (default 24 hours, up to seven days), sending both current and previous signature headers during the overlap so your receivers update on their own schedule. And every webhook URL passes through a guard that rejects loopback, private, link-local, and cloud-metadata addresses, re-checked at every delivery so a DNS rebind can't trick the worker into reaching an internal service later.
Tenant isolation by architecture, not by a WHERE clause
The most common API risk on multi-tenant software is filter-by-tenant going wrong: a forgotten WHERE clause, a misrouted lookup, a path parameter the wrong layer trusted. One slip and a key from one customer reads another customer's data. Mobieus rules out that entire class of bug structurally. Every tenant has its own database, and a request connects to that database before the controller ever runs. Your API key is looked up in your tenant's database, and there's no cross-tenant lookup table for it to live in. A key minted in your tenant cannot read another tenant's data, because the connection it's running through is the wrong one. This is verified with a live cross-tenant test confirming that keys from one tenant get a 401 from every other tenant.
It covers nearly the whole product, and it writes
The early releases were read-only. You could pull events, users, posts, and listings, but anything that changed the community had to happen in a browser. That's no longer true. The API now writes across the core surface, so an outside system can act on your community instead of only observing it. A reply created through the API takes the exact same path a member's reply does: it's sanitized, it counts toward the thread, it notifies subscribers, it resolves mentions, and it fires a webhook. An API reply and a web reply are the same reply.
The breadth is the part worth sitting with. Beyond forums, the API now reaches mobieusMarket listings (create, edit, sell, withdraw, plus buyer Q&A), file uploads straight into the moderation queue, the full moderation and reporting surface, the events calendar with RSVPs, and the social graph for follows and reactions. The learning side is unusually deep: mobieusLearn exposes course authoring end to end, including modules, lessons, enrollments, attempts, certificates, SCORM packages, and a native xAPI learning record store. mobieusKnow handles knowledge-base pages with the same approve-and-reject revision flow as the in-product editor, and a search endpoint that lets an AI agent ground its answers in your community's own knowledge. mobieusHelp covers the full help desk, with eight AI hooks that put your own AI key to work on the queue: drafting replies, summarizing long threads, routing and tagging tickets, flagging unhappy ones, predicting resolution, auditing agent quality, and spotting the questions your knowledge base doesn't yet answer. You can even schedule live sessions on Google Meet, Zoom, or Webex through the API, with Mobieus building the calendar invite and sending reminders, no provider OAuth required.
Modern conveniences are in place too: CORS with preflight handling so browser apps can call the API directly, an Idempotency-Key header that makes POST retries safe instead of duplicating tickets, pagination that returns total_count and has_more so you can render "showing 1–20 of 847" without a second call, and SCIM 2.0 for provisioning.
How this compares to Skool, Circle, and Discord
This is where the difference gets concrete. Skool, despite "owning your community" being part of its appeal, offers no official public REST API. Operators stitch things together through basic native webhooks and Zapier, and the unofficial third-party tools that have sprung up describe their own coverage as limited and early-stage. Circle does ship a genuine API, but access starts on its Business plan at $199/month, and real-time outbound webhooks are reserved for the enterprise Circle Plus tier, so a Business customer is often left polling or routing through Zapier. Discord has a powerful bot API, but it's a chat platform, with no native courses, help desk, or marketplace to integrate in the first place.
| Capability | Mobieus | Skool | Circle |
|---|---|---|---|
| Official public REST API | Yes, on Pro and up | No (Zapier + unofficial tools) | Yes, Business plan ($199/mo)+ |
| Signed, retrying webhooks | HMAC-signed, auto-retry, replay-safe | Basic, mostly via Zapier | Outbound webhooks on Circle Plus |
| Write to the community via API | Yes, across the core surface | Minimal | Yes (Admin / Headless) |
| LMS, help desk, and AI endpoints | Yes (courses, SCORM, xAPI, AI hooks) | No | Limited |
| Published OpenAPI spec + docs | OpenAPI 3.1 + Redoc | Unofficial only | Yes |
What you can do today
Mint a key at /admin/api-keys, copy it once, and store it in your secret manager. Subscribe a Slack-compatible webhook to post.created and start mirroring new posts in seconds. Point user.registered at your email tool so welcome series fire from the source of truth. Read the event log on a cron to build a local analytics replica. Every write acts as the key owner and is fenced by a scope, so an integration gets exactly the access it needs and nothing more.
The public API is available on Pro, Creator Plus, and Sovereign plans. Point your tooling at the docs, see how the plans line up on our pricing page, and if there's an event or endpoint you need that isn't exposed yet, tell us in support and it goes on the list.