API reference

Forklink does not have an open API yet. This is the API of the link product Forklink is built on; Forklink's public address (planned at api.forklink.co) does not exist yet. The route, field and code names below are those of the OpenAPI deployed in staging and may change before launch.

• Key: header Authorization: Bearer cl_live_… (cl_test_… in staging). Keys are created in the workspace's Links panel, not through the API: a key cannot create keys (tested: 403).
• Permissions: full, read (GET only) and track (only /track/*, for your site's backend). Tested: a read key reads (200) and cannot write (403).
• Rate: the OpenAPI declares 20 requests per second per key with a burst of 40; beyond that, 429 with retry-after. Observed in staging: with 300 parallel requests, 140 received 429 (retry-after 1).
• New accounts: when the new-account policy is on (it is in staging), keys and custom domains are unavailable until the account is verified (403 ACCOUNT_NOT_VERIFIED).
• Base server: /api on the API host.

Run on 2026-11-09 against Links staging (OpenAPI version 2026-09-18) with a cl_test_… key from a test tenant: 17 of 18 checks passed; the keys and the test link were deleted afterwards.

# List
curl -s "$BASE/links?limit=5" -H "Authorization: Bearer $KEY"

# Create
curl -s -X POST "$BASE/links" -H "Authorization: Bearer $KEY" -H "Content-Type: application/json" \
  -d '{"destinationUrl":"https://example.com/launch","slug":"launch","title":"Launch","utmSource":"newsletter","utmMedium":"email","utmCampaign":"launch"}'

# Analytics for the last 7 days
curl -s "$BASE/links/$ID/analytics?days=7" -H "Authorization: Bearer $KEY"

# Delete
curl -s -X DELETE "$BASE/links/$ID" -H "Authorization: Bearer $KEY"

Replace $BASE with the API server (https://<host>/api), $KEY with your key and $ID with the id returned on create. Verified responses: the list returns {items, limit, page, total}; create returns the link (201) with id, slug, domain, destinationUrl, status, totalClicks…; analytics returns totalClicks, uniqueClicks, timeseries, byCountry, byReferrer…; delete answers 204.

Errors look like {"error": "…", "code": "…"}. Verified in staging: 400 INVALID_BODY (with details), 401 MISSING_API_KEY, 403 FORBIDDEN (insufficient permission) and 429 with retry-after.

402 (plan limits): built, not verified. By the meters design, reaching the active-links or custom-domains cap makes the API answer 402 with COMMERCIAL_LIMIT_REACHED (LINKS_ACTIVE_LIMIT_REACHED or CUSTOM_DOMAINS_LIMIT_REACHED, with limit and current); links already published keep redirecting. That code landed but the service deployed in staging is older (the deployed OpenAPI does not list it): I could not test it. Exceeding the month's clicks produces no 402: redirects continue and the analytics detail for the excess stops being stored. Per-plan caps are not approved for production.

Events: link.created, link.updated, link.archived, link.clicked, link.click_limit_reached, link.expired, conversion.lead, conversion.sale, domain.verified, app.opened, app.installed. Svix-style signature (webhook-id, webhook-timestamp, webhook-signature: v1,<base64 HMAC-SHA256> over {id}.{ts}.{body}), up to 8 retries with growing delay; the endpoint is disabled after 50 consecutive failures. Source: Links' OpenAPI and code; I did not test them end to end in this delivery.

• GET /status.json is listed as public under /api, but there it asks for a key (401): the public route is /status.json at the host root.
• GET /links/{id}/qr answered 500 INTERNAL_ERROR in staging on 2026-11-09: I leave it out of the tested examples. The free QR tool on this site does not depend on the API.

Links

Analytics

Conversions

Domains

UTM presets

Tags

Groups

QR

Link-in-bio

Webhooks

Integrations

Mobile apps

Status

Deep links