Product · Developers

A public REST API your engineers will not hate.

OpenAPI 3.1, HMAC-signed webhooks with retry and replay, tenant-isolated keys, per-key rate-limit overrides in the admin UI, and a real spec at /api/docs. Available on Pro and up.

Start free trial See pricing

Pro and up · OpenAPI 3.1 · HMAC-signed webhooks

POST /api/v1/webhooks Register an endpoint in one call subscribe to events, get a signing secret shown once

Delivery HMAC-SHA256 signed Mobieus-Signature: t=<unix>,v1=<hex>

Retry schedule 0/1/5/30/120/360/1440 min auto-disable + replay from /admin/webhooks

Rate limits X-RateLimit on every response per-key → tenant → platform precedence

OpenAPI3.1 spec at /api/docs

0%platform fee on your commerce

7exponential-backoff retry steps

SHA-256HMAC-signed every delivery

What you get

A real API, not a screen-scraping rumor.

Available on Pro and up. Tenants on Starter get 403 plan_gated.

Cursor-paginated event log

GET /api/v1/events returns every public event newest-first. Filter by type or since. Walk the whole log with one cursor field.

Resource endpoints

Users, posts, mobieusMarket listings, files, moderation reports, moderation actions. JSON, scoped per key, paginated.

HMAC-signed webhooks

Every delivery carries Mobieus-Signature: t=<unix>,v1=<hex>. Verify with HMAC-SHA256 + your secret. Replay attack protection via 5-minute timestamp tolerance.

Exponential-backoff retry

Failed deliveries retry on 0/1/5/30/120/360/1440 minute schedule. Endpoints auto-disable after configurable failures. Replay any past delivery from /admin/webhooks.

SSRF + DNS-rebind protection

Webhook URLs blocked from loopback, RFC1918, link-local, cloud metadata. Validated at registration AND at every delivery.

Dual-signing rotation

Rotate the signing secret and both old and new signatures ride in the header for a configurable grace window. Roll over receivers without downtime.

Tenant-isolated keys

Keys are stored as SHA-256 hashes in your tenant DB. Constant-time compare. A key minted on tenant A literally cannot read tenant B.

Per-key + per-tenant rate limits

Set a rate limit per key on the admin UI. Override the tenant default. Three-layer precedence (per-key → tenant → platform). X-RateLimit headers on every response.

mobieusCM drafts Pro+

Programmatically list, approve, edit, or reject mobieusCM drafts via the API. Wire approvals into your existing review tools. Every draft still needs an approval. Drafts and decisions appear in the public event log so you can pipe them into your own pipelines, audit trails, or analytics.

OpenAPI 3.1 + Redoc

The spec is the contract. Browse interactively at /api/docs. Feed the raw YAML at /api/openapi.yaml into any code generator.

What it looks like

Mint a key, fetch events, verify a webhook.

The same patterns your team already knows — Bearer tokens, JSON, standard HTTP status codes.

Fetch events

GET /api/v1/events

curl https://YOUR-TENANT.mobieus.io/api/v1/events?limit=10 \
  -H "Authorization: Bearer mc_live_..."

# =>
{
  "data": [
    { "id": "evt_01j...",
      "type": "post.created",
      "created_at": "2026-05-29T13:42:11Z",
      "data": { ... } }
  ],
  "next_cursor": "NDI=",
  "request_id": "req_..."
}

POST /api/v1/webhooks

curl -X POST https://YOUR-TENANT.mobieus.io/api/v1/webhooks \
  -H "Authorization: Bearer mc_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://api.you.com/hook",
    "subscribed_events": ["post.created", "report.created"]
  }'

# => 201 Created (signing_secret shown once)

Verify a webhook (Node)

webhook-verify.js

const crypto = require("crypto");

function verify(rawBody, header, secret) {
  const parts = Object.fromEntries(
    header.split(",").map(p => p.split("="))
  );
  const signed = parts.t + "." + rawBody;
  const expected = crypto
    .createHmac("sha256", secret)
    .update(signed).digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(parts.v1)
  );
}

Developer resources

Everything you need to get started.

The spec is the contract. The guide is the quickstart. The release post is the changelog.

Reference

OpenAPI spec + Redoc

Browse the interactive reference at /api/docs, or pull the raw YAML from /api/openapi.yaml into any code generator.

Guide

REST API quickstart

Mint a key, make your first call, paginate the event log, and set up a test webhook endpoint in under ten minutes.

Webhooks

HMAC verification guide

Step-by-step verification in Node, Python, PHP, and Ruby. Covers dual-signing rotation and the replay-attack window.

Browse the OpenAPI spec Read the API guide

Questions

Before you build on it.

Which plan includes the API?

Pro and up. Tenants on Starter receive 403 plan_gated on every API request. The full plan breakdown is on the pricing page.

How do I verify a webhook signature?

Every delivery includes a Mobieus-Signature header with a Unix timestamp and an HMAC-SHA256 hex digest. Compute the same HMAC over t.rawBody using your signing secret and compare with a timing-safe equality check. The webhooks guide has copy-paste examples in Node, Python, PHP, and Ruby.

Can I rotate a signing secret without downtime?

Yes. Dual-signing lets you rotate the secret while both the old and new signatures ride in the header for a configurable grace window. Roll over your receiver, confirm it is verifying with the new secret, then close the window.

How does tenant isolation work?

API keys are stored as SHA-256 hashes in the per-tenant database. A constant-time compare authenticates every request. A key minted on tenant A has no path to tenant B’s data — not through shared state, not through the platform layer.

Can I pipe mobieusCM drafts through my own review workflow?

Yes, on Pro and up. The API exposes endpoints to list, read, approve, edit, and reject drafts. Wire them into Slack, Linear, GitHub Actions, or any review tool you already use. Every draft still requires a human approval before it sends.

Do I own my data and can I export it?

Yes. Your members, content, custom domain, and Stripe account are yours, exportable any time through the REST API and signed webhooks. We do not hold your data hostage.

Start when you are ready

Try Mobieus free for 14 days.

No credit card. Bring your own Stripe. Cancel any time. Your data stays yours.

Start free trial Book a demo See pricing