RastroAff REST API: keys, permissions, endpoints and limits

The REST API gives programmatic access to what you see in the dashboard. It's included from the Starter plan.

Create a key

In the API menu, create a key. Choose whether it can only read or also write, and an expiry date if you want. The key (it starts with rst_) is shown only once: keep it somewhere safe. You can revoke it at any time.

Send it in the header of every request:

curl https://rastroaff.com/api/v1/me -H "Authorization: Bearer rst_..."

What each key sees

The key has the type and scope of the account that created it:

• Admin: the whole network.
• Manager: the affiliates assigned to them.
• Advertiser: their campaigns; they can record conversions and send player activity.
• Affiliate: their traffic, earnings and payouts.

Admin accounts need two-factor authentication turned on to use the API.

Endpoints

• /api/v1/campaigns: list, create, edit and change the status of offers.
• /api/v1/affiliates and /api/v1/advertisers: list, view, edit, approve.
• /api/v1/clicks and /api/v1/conversions: list and, for advertisers, record conversions.
• /api/v1/reports: the same engine as the dashboard reports.
• /api/v1/payouts: payout requests and their status.
• /api/v1/postbacks: the log of postbacks sent.

The full specification (OpenAPI 3.1) is at /api/v1/openapi.json, in the request's language.

Limits and errors

• 600 requests per minute per key. The X-RateLimit-* headers tell you how many are left; above the limit, the response is 429.
• Errors come as JSON with a code (unauthorized, insufficient_scope, validation_error…) and a message.

To receive events instead of fetching them, use webhooks.