REST API overview
The hosted API base URL is https://api.linkrunway.com. Send JSON with Content-Type: application/json and a Bearer API key. Public integration routes are under /v1; SDKs add this prefix themselves, so configure the base URL without /v1.
Endpoint directory
| Method | Path | Credential | Reference |
|---|---|---|---|
| POST | /v1/server/links | Server | Create a link |
| GET | /v1/server/links | Server | List links |
| GET | /v1/server/links/:id | Server | Read a link |
| PATCH | /v1/server/links/:id | Server | Update or archive |
| POST | /v1/track | Publishable or server; revenue requires server | Events |
| POST | /v1/resolve | Publishable or server | Resolve |
| POST | /v1/shares | Publishable or server | Shares |
| POST | /v1/deferred | Publishable or server | Referral codes |
| POST | /v1/deferred/claim | Publishable or server | Referral codes |
| POST | /v1/installs/match | Publishable or server | Install matching |
| POST | /v1/claims/apple-ads | Publishable or server | Network evidence |
| POST | /v1/claims/referrer | Publishable or server | Network evidence |
| POST | /v1/mcp | MCP token only | MCP |
This reference covers the supported integration surface above. Signed-in console routes, billing administration, and internal operator endpoints are not server-key APIs. Prefer the console for those workflows. Platform-specific attestation is documented in the individual SDK guides.
Request conventions
JSON request objects are validated strictly. Send only documented fields. Identifiers are case-sensitive unless a field explicitly says otherwise. Dates use ISO 8601 UTC timestamps, for example 2026-11-02T12:00:00.000Z. Currency amounts use integer minor units, never floating-point major units.
Metadata is a flat object of at most 30 fields. Keys are at most 64 characters; values are strings of at most 1,000 characters, finite numbers, booleans, or null. Nested objects and arrays are not accepted.
Responses
Treat any documented successful 2xx response as success and parse its JSON body. Creation and event POST routes normally return 201; install matching returns 200. Responses may gain additional fields, so read the fields your integration needs rather than rejecting unknown response properties.
A returned link includes shortUrl; use that value instead of constructing a URL from the key. An event returns { id, attributed, duplicate }. The id is LinkRunway's internal event ID; it is different from your stable eventId.
Idempotency and limits
Event ingestion deduplicates by workspace and event ID within the caller's trust namespace. Server link creation uses a required stable link key. There is no general Idempotency-Key header contract for every route. Shares and setup tools can create a new object on every call.
Enforced plan limits can return 402. Transient request throttling returns 429. Do not treat these as equivalent. Read errors and retries and preserve request identity across retryable failures.
Start with an SDK
The SDKs implement consent handling, attribution state, and request retries. Direct HTTP is useful for backend integrations or runtimes without a wrapper. Browser event queues are bounded and are not a durable payment-delivery mechanism.