Skip to main content
Both APIs use https://api.aws53.cloud as the base URL. Create or manage your organization API key in Settings > API Keys and send it in the X-API-Key header for operations that support API-key authentication.
Keys are scoped to an organization. Use resource IDs from that organization. Regenerating a key invalidates the previous one; update every backend that uses it. Do not place keys in browser code or pixel URLs.

​
Authentication by API

Do not send an sk_... API key as a Bearer token.
The hosted Orbit specification currently conflicts on integration, destination, and delivery authentication: its security declarations allow API keys, but its operation descriptions require a non-viewer member using Bearer authentication. API-key support for these operations needs confirmation from Leadpipe before you rely on it. The generated authentication control alone does not resolve this discrepancy.

​
Read the endpoint’s error response

The generated endpoint reference defines the status codes and response body for each operation. Identification and Orbit do not use one universal error envelope. For an Orbit results read, 202 means the run is still queued or running. Failed or cancelled runs return a conflict. See the polling example.

​
Rate limits and retries

For Identification visitor reads and qualification queries, use RateLimit-Limit, RateLimit-Remaining, and RateLimit-Reset. The reset value is in seconds. A 429 response also documents Retry-After in seconds. Do not hardcode an allowance from another endpoint. Orbit has endpoint-specific allowances. Public catalog requests and site analysis have different authentication behavior; see Find topics. Use bounded retries for reads. Before retrying a write, check whether it supports safe repetition. Orbit run creation supports Idempotency-Key: reuse the same key for retries of the same intended run, and choose a new key for a new run. Do not assume that every write accepts that header. For troubleshooting, record the method, path, HTTP status, and request ID when available. Remove API keys and personal visitor data from shared logs.