Public REST API. Key-authenticated, OpenAPI-documented.
Read your OGRECORDS™ catalogue and manage smart links and draft releases programmatically — over a plain REST API. Authenticate with a scoped API key you create in your dashboard. Early access on request.
Overview: REST API, scoped keys, rate limits, OpenAPI
REST read + write
Read your releases, tracks, smart links and stats — and create or edit your smart links and draft releases — over plain HTTPS. JSON responses, limit/offset pagination, predictable schemas. Distribution and submit stay out of the API.
Scoped API keys
Authenticate with an ogr_pk_ key sent as a Bearer token or in the X-API-Key header. Each key carries explicit scopes — read:releases, read:smartlinks, read:stats, write:smartlinks, write:releases — and is rotatable and revocable any time from your dashboard.
Rate limits + headers
Every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset. Over quota returns 429 with a Retry-After. Free keys get 1,000 requests/day, business keys 100,000.
Self-hosted OpenAPI 3.0
The full machine-readable spec is served at /api/v1/public/openapi.json and renders as an interactive reference on this site — no third-party docs host, no external calls.
The endpoints available at launch.
Every endpoint is authenticated with a scoped API key and served from https://api.og-records.com. Read endpoints plus owner-scoped writes for smart links and draft releases — distribution and submit are not exposed.
Get notified when a release changes state.
Register an HTTPS endpoint and we POST a signed JSON event whenever one of your releases is delivered, rejected or taken down. Manage endpoints from your dashboard — each one gets its own signing secret, shown once.
Events at launch
- release.delivered — the release was delivered to the stores.
- release.rejected — a store or QC step rejected the release.
- release.takedown — the release was taken down.
- release.live — the release is now live on the stores.
Every delivery carries these headers
- X-Webhook-Signature — lowercase-hex HMAC-SHA256 of the raw request body, keyed by your signing secret.
- X-Webhook-Timestamp — ISO-8601 send time, equal to the created_at in the body.
- X-Webhook-Event — the event name, e.g. release.delivered.
- X-Webhook-Id — a unique id for this delivery.
The payload is a JSON body with id, event, created_at and a data object holding release_id. To verify it, recompute HMAC-SHA256 over the exact raw body using your signing secret and compare it against X-Webhook-Signature with a timing-safe check — then confirm X-Webhook-Timestamp is within about five minutes of now to reject replays.
Failed deliveries retry with exponential backoff. After 15 consecutive failures the endpoint auto-disables and you register it again to resume.
Manage webhooks in your dashboard.
API keys with scopes.
Create a key in your dashboard and send it as an Authorization: Bearer ogr_pk_… header, or in the X-API-Key header. Every key is scoped — read:releases, read:smartlinks, read:stats, write:smartlinks, write:releases — so an integration only gets what it needs. Keys are rotatable and revocable at any time. Write access is owner-scoped and never triggers distribution; OAuth is not part of this launch.
What your key is allowed to do.
The default for every new key. Fine for dashboards, cron syncs and prototyping.
A higher daily quota for production integrations. Available on request.
Every response includes X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset. Once the daily quota is exhausted we return 429 with a Retry-After header — the number of seconds until the window resets.
Build on your catalogue.
The public API is in early access. Tell us what you want to build and we'll enable API keys on your account.