Outcron Plain HTML

REST API

The Outcron API provides programmatic access to your organizations, jobs, schedules, executions, alerts, reports, billing, and related resources. All endpoints are under the /api/v1 prefix.

Authentication

JWT Tokens

Obtain a token via POST /api/v1/auth/login with your email and password. Include it in subsequent requests:

Authorization: Bearer eyJhbGciOiJIUzI1NiIs...

Non-browser bearer tokens expire after the configured JWT lifetime, 24 hours by default. Refresh with POST /api/v1/auth/refresh.

Browser sessions use a short-lived in-memory access JWT plus HttpOnly refresh cookies. Browser refresh and logout calls send X-Outcron-Browser-Session: 1 and X-Outcron-CSRF matching the readable outcron_csrf cookie.

API Keys

For long-lived programmatic access, create an API key in the dashboard or via the API:

Authorization: Bearer outk_a1b2c3d4e5f6...

See API Keys for details.

API keys are org-scoped and only carry the explicit permissions assigned to the key. They cannot access support ticket routes, platform-admin surfaces, or org-admin-only actions. Omitted or empty permissions deny org-member API access.

Base URL

All API requests use the service base URL:

https://outcron.com/api/v1/...

/api/v1 is the stable API version. Compatible fields and endpoints may be added over time; incompatible changes require a future major API path except for urgent security or data-loss fixes.

Org-Scoped Endpoints

Most endpoints are scoped to an organization:

/api/v1/orgs/{orgID}/jobs
    /api/v1/orgs/{orgID}/schedules
    /api/v1/orgs/{orgID}/executions

The {orgID} is the organization's canonical ocx identifier. Some older endpoints and tools may still accept legacy bare SCRU128 identifiers.

Pagination

List endpoints support pagination with query parameters:

ParameterDefaultMaxDescription
limit50200Number of items per page
offset0—Number of items to skip

Responses include pagination metadata:

{
      "data": [...],
      "total": 142,
      "limit": 50,
      "offset": 0
    }

Common Responses

StatusMeaning
200Success
201Created
400Bad request (validation error)
401Unauthorized (missing or invalid token)
403Forbidden (insufficient permissions)
404Not found
429Rate limited (see Rate Limiting)
500Internal server error

Platform-admin-only routes intentionally return 404 to non-platform-admin callers so hidden administrative surfaces are not exposed.

Errors

JSON errors use a standard envelope:

{"error":"message","code":"invalid_request"}

Display the error message to users. Programmatic clients should branch on the stable code value, tolerate unknown codes, and handle older deployments that may omit code.

Request Body

Mutation endpoints (POST, PUT, PATCH) accept JSON request bodies. The default max body size is 1 MiB. Support file-upload endpoints accept 26 MiB HTTP bodies to leave room for multipart overhead; default attachment limits are 10 MiB per file, 25 MiB total payload, and 5 files.

Content-Type: application/json

Key Endpoints

Authentication

Jobs

Schedules

Executions

Dashboards

Reports

Data Exports

Exports are available for executions, audit logs, jobs, schedules, and alert events. Large exports may be queued and delivered by email when ready.

One-time public export links can be downloaded without login, expire 24 hours after the artifact becomes ready by default, and are consumed once streaming starts. Background CSV and TSV exports download as .csv.zip and .tsv.zip.

Alerts

Billing

Support

Support routes require a user session; API keys are rejected.