Fastorama

Fastorama Public API

Reference for `/api-docs`: **maintenance plans** (`GET /maintenance-plans`) plus integrator notes below. The live **`public-api-gateway`** may register additional **`options.publicApi`** routes (e.g. auth in `@app/shared`); this file keeps **operation paths** small. --- ### Rate limits (HTTP API gateway) Sliding window (`rateLimitAllow`). **`429`** with `success: false`, `message: rate_limited` when exceeded. | Bucket | Limit | Window | Applies | |--------|------:|--------|---------| | `public-api-global:<ip>` | 400 | 60s | Every `/api/v1/*` after routing succeeds | | `register:<ip>` | 20 | 60s | `POST /auth/register/user` | | `api-key-session:<ip>` | 120 | 60s | `POST /auth/session/api-key` | | API key resolve | 120 / IP; 400 / key-hash prefix | 60s | During Bearer API-key resolution | Cloud Armor or other edge throttling may also apply on `api.*` hosts. --- ### Client webhooks — verifying `Fastorama-Signature` Webhooks are **not** listed as paths here; endpoints are configured in **Profile → Integrations → Webhooks**. Each delivery is **`POST`** with JSON body and header **`Fastorama-Signature: t=<unix_seconds>,v1=<hex>`**. 1. Read the **raw** body (do not re-serialize JSON). 2. Compute **HMAC-SHA256** over **`t + "." + raw_body`** using your endpoint signing secret. 3. Compare digest to **`v1`** (lowercase hex) with a **timing-safe** compare. 4. Reject if **`|now - t| > 300`** seconds (skew guard; `CLIENT_WEBHOOK_SIGNATURE_CLOCK_SKEW_SEC` in `@app/shared`). Also sent: **`Fastorama-Event-Id`**, **`Fastorama-Event-Type`**, **`Fastorama-Delivery-Id`**, **`User-Agent: Fastorama-Webhooks/1.0`**, **`Content-Type: application/json`**. Full topics, envelope, and ops: sign in and open **Documentation → Features → Client webhooks** (`/docs/features/webhooks`).

Guides

API reference

  • Maintenance plans— Underhållsplaner — plans the caller may access with a user API key (`fast_…`, Integrations).