API overview
Splyntra exposes a small, stable HTTP surface: an OpenTelemetry ingest
endpoint that every SDK and raw OTel exporter speaks, plus a set of /v1 REST
endpoints for scoring, guarding, and — in the commercial editions — governance,
identity, and compliance.
Authentication
All requests authenticate with an ingest key sent as a bearer token:
Authorization: Bearer <ingest key>
Mint an ingest key in the dashboard under Settings → API keys, or let the Connect an agent wizard create one for you. Keys are stored only as SHA-256 hashes — the raw value is shown once at creation.
splyntra_dev_key is a development-only fallback. It is accepted only when the
collector runs with ENV/NODE_ENV=development, and is rejected in production
(fail-closed). Never ship it.
For multi-tenant deployments, the dashboard BFF talks to the collector with a
trusted service token (COLLECTOR_SERVICE_TOKEN) and scopes each request with an
X-Splyntra-Org-Id header. See Ingest & OTLP.
Base URLs
| Deployment | Ingest / API base | Dashboard |
|---|---|---|
| Splyntra Cloud | https://ingest.splyntra.com | https://app.splyntra.com |
| Self-host | http://localhost:4318 | http://localhost:3000 |
Endpoint families
| Family | Paths | Availability |
|---|---|---|
| OTLP ingest | /v1/traces, /v1/logs | Open core |
| Scorers | /v1/scorers | Open core |
| Guard | /v1/guard | Open core |
| Platform webhooks | /v1/integrations/<platform> | Open core |
| Governance | /v1/ledger, /v1/policies, /v1/delegation, /v1/spend-limits, /v1/approvals, /v1/approval-rules, /v1/authorize | Commercial |
| Compliance | /v1/compliance/* | Commercial |
| Identity | /v1/identity/* | Commercial |
The commercial /v1 endpoints are registered by the collector-cloud binary,
which blank-imports the ee/* modules at build time. The Community collector
imports none of them, so those paths return 404 in Community — this is by
design, not a configuration error. See
Editions & licensing.
Where to go next
- Ingest & OTLP — the OTLP/HTTP endpoints, headers, and semantic conventions the collector reads.
- REST API (/v1) — the commercial governance, identity, and compliance surface, grouped by area, with plan tiers.
- SCIM 2.0 — user provisioning for SSO-managed organizations.