Resources

API Documentation

The Webmachine REST API allows you to integrate with our affiliate marketing platform programmatically. All endpoints use JSON request and response bodies, and are served at the base URL of your deployment.

Overview

Base URL

https://marketplace.webmachine.io/api/v1

Authentication

Most endpoints require a Bearer token in the Authorization header. Obtain tokens via the login endpoint. Tokens expire after 30 minutes and can be refreshed using the refresh endpoint with an HTTP-only cookie.

Authorization: Bearer <access_token>

Response Format

All responses follow a consistent envelope format:

// Success
{
  "success": true,
  "data": { ... },
  "meta": {
    "page": 1,
    "per_page": 20,
    "total": 150,
    "total_pages": 8
  }
}

// Error
{
  "success": false,
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "...",
    "details": { ... }
  }
}

Rate Limiting

API requests are rate limited to 100 requests per window. Login attempts are limited to 5 consecutive failures before temporary lockout. Rate limit headers are included in all responses.

Endpoints

Authentication

POST/api/v1/auth/register
None

Register a new user account (name, email, password, role)

POST/api/v1/auth/login
None

Login with email and password. Returns access_token + refresh cookie

POST/api/v1/auth/refresh
Cookie

Refresh the access token using the refresh cookie

POST/api/v1/auth/logout
Bearer

Logout and clear the refresh cookie

GET/api/v1/auth/me
Bearer

Get the current authenticated user profile

GET/api/v1/auth/sessions
Bearer

List all active sessions for the current user

DELETE/api/v1/auth/sessions/:id
Bearer

Revoke a specific session by ID

Two-Factor Authentication

POST/api/v1/auth/2fa/setup
Bearer

Initiate 2FA setup. Returns QR code URI and backup codes

POST/api/v1/auth/2fa/verify
Bearer

Verify 2FA setup with a 6-digit TOTP code

POST/api/v1/auth/2fa/disable
Bearer

Disable 2FA. Requires current password and TOTP code

POST/api/v1/auth/2fa/verify-login
temp_token

Complete login when 2FA is enabled

Websites

GET/api/v1/websites
Bearer

List websites (own for advertisers, all for admins)

POST/api/v1/websites
Advertiser

Submit a new website for approval

PATCH/api/v1/websites/:id/approve
Admin

Approve a pending website

PATCH/api/v1/websites/:id/reject
Admin

Reject a website (reason required)

POST/api/v1/websites/:id/resubmit
Advertiser

Resubmit a rejected website

Campaigns

GET/api/v1/campaigns
Bearer

List campaigns. Filtered by role automatically

POST/api/v1/campaigns
Advertiser

Create a new campaign (checks wallet balance)

PATCH/api/v1/campaigns/:id
Advertiser/Admin

Update campaign details

PATCH/api/v1/campaigns/:id/status
Advertiser/Admin

Change campaign status

POST/api/v1/campaigns/:id/join
Affiliate

Join a campaign (creates tracking link)

DELETE/api/v1/campaigns/:id/leave
Affiliate

Leave a campaign

Tracking

GET/api/v1/affiliate/links
Affiliate

List all tracking links for the current affiliate

POST/api/v1/affiliate/links
Affiliate

Create a new tracking link for a campaign

GET/api/v1/track/:code
Public

Click redirect endpoint (records tracking event)

POST/api/v1/track/conversion
Public/S2S

Record a server-to-server conversion postback

Wallet & Payments

GET/api/v1/wallet/balance
Bearer

Get wallet balances (total, available, reserved, spent)

GET/api/v1/wallet/transactions
Bearer

List transaction history

POST/api/v1/wallet/fund
Advertiser

Add funds to advertiser wallet

POST/api/v1/wallet/withdraw
Affiliate

Request a withdrawal

GET/api/v1/wallet/wallets
Affiliate

List saved crypto wallet addresses

POST/api/v1/wallet/wallets
Affiliate

Add a new crypto wallet (24h verification)

Postbacks

GET/api/v1/postbacks
Affiliate/Admin

List postback configurations

POST/api/v1/postbacks
Affiliate

Create a new postback URL

PATCH/api/v1/postbacks/:id
Affiliate

Update a postback configuration

DELETE/api/v1/postbacks/:id
Affiliate

Delete a postback

GET/api/v1/postbacks/:id/logs
Affiliate/Admin

View postback fire logs

Real-Time Events (SSE)

Event Stream

GET /api/v1/events/stream?token=<access_token>

Connect to the SSE endpoint to receive real-time updates. Events include website approvals, campaign status changes, tracking events, wallet updates, fraud alerts, and force-logout signals.

Need API Support?

Contact [email protected] for API integration assistance. Webmachine is a product of PRPPC OU, Tallinn, Estonia.

Related: Help Center | Blog | Platform Status