API Documentation

REST API reference, authentication, webhooks, and integration guides.

Authentication

The API supports two authentication methods:

API Key (recommended for server-to-server)

Send your API key in the X-API-Key header. Keys are created in Settings > API Keys with specific scopes.

curl -H "X-API-Key: sg_live_your_key_here" \
  https://api.scalegrowth.digital/api/v1/campaigns

JWT Bearer Token (for frontend/user sessions)

Obtain tokens via POST /api/v1/auth/login. Access tokens expire in 15 minutes; refresh tokens last 7 days.

curl -H "Authorization: Bearer eyJhbG..." \
  https://api.scalegrowth.digital/api/v1/campaigns

Key Endpoints

Method	Endpoint	Description
POST	/api/v1/auth/signup	Create a new account
POST	/api/v1/auth/login	Login and receive tokens
POST	/api/v1/auth/refresh	Refresh access token
GET	/api/v1/orgs	List your organizations
GET	/api/v1/orgs/:id/campaigns	List campaigns
GET	/api/v1/orgs/:id/leads	List leads
POST	/api/v1/orgs/:id/leads	Create a lead
GET	/api/v1/orgs/:id/analytics	Get analytics data
GET	/api/v1/orgs/:id/experiments	List experiments
POST	/api/v1/orgs/:id/experiments	Create experiment
GET	/api/v1/orgs/:id/billing	Get billing info
GET	/api/v1/health	API health check

Full API reference with request/response schemas coming soon. All endpoints require authentication.

Rate Limiting

API requests are rate limited per API key:

• Starter: 100 requests/minute, 10,000/day
• Professional: 500 requests/minute, 50,000/day
• Enterprise: Custom limits

Rate limit headers are included in every response:X-RateLimit-Remaining,X-RateLimit-Reset. When limited, you receive a 429 response with a Retry-After header.

Webhooks

Configure webhook endpoints in Settings > API Keys > Webhooks. Scalegrowth sends POST requests with JSON payloads for events like:

• campaign.status_changed — Campaign paused, resumed, or ended
• lead.created — New lead captured
• experiment.completed — A/B test has a winner
• ai.action_executed — AI performed an automated action
• budget.alert — Budget threshold exceeded

Each webhook includes an HMAC-SHA256 signature in the X-Signature header for verification.