AuthianeA brand of Das Digitale Momentum
Deutsch Join the waitlist

Developers: website API and agent access

This page documents the API of this website only. It is not the documentation of the Authiane platform; the platform is in early access and has no public API yet.

What is available

  • POST https://www.authiane.com/api/v1/waitlist — add an e-mail address to the early-access waitlist. No authentication.
  • GET https://www.authiane.com/api/v1/status — zero-auth probe with the environment and the discovery links.
  • GET /api/v1/waitlist/stats — aggregate counts, protected by an OAuth 2.0 access token.
  • POST https://www.authiane.com/api/v1/oauth/token — issue an access token with the client-credentials grant.
  • GET https://www.authiane.com/api/v1 and GET https://www.authiane.com/sandbox/api/v1 — zero-auth index of each base path with its status probe, token endpoint and discovery documents.
  • OpenAPI 3.1 document for all four operations, with a Markdown twin.
  • API catalog (RFC 9727) that lists both API base paths and points to the OpenAPI document, this page and the status probe.
  • Guidance for language models and agents, the XML sitemap, the crawler rules and the security contact.

Quickstart

Submit an address only with the explicit consent of its owner. The call is idempotent: a known address is updated, and the answer is the same in both cases.

curl -sS -X POST https://www.authiane.com/api/v1/waitlist \
  -H 'Content-Type: application/json' \
  -d '{"email":"you@company.com","consent":true,"source":"cta","lang":"en"}'
HTTP/1.1 200 OK
{"accepted":true}

A form-encoded submission is answered with a 303 redirect to a thanks page instead of JSON, so the forms on this site work without JavaScript.

Request fields

email
required, string, valid address up to 254 characters, stored lower-cased
consent
required, must be true: the owner of the address agreed to be notified
source
optional: hero or cta, the form on this site that was used
lang
optional: en or de, language of the notification, default en
website
honeypot, must stay empty; a value ends the request without an error

An unknown field is rejected with 400 invalid_request rather than ignored.

Responses and errors

  • 200 — stored, updated or already known; body {"accepted":true}.
  • 303 — a form-encoded submission was accepted; Location points at the thanks page.
  • 400 — unknown field, invalid enum value or malformed JSON.
  • 405 — wrong method; the Allow header names the accepted ones.
  • 413 — body larger than 64 KB.
  • 415 — Content-Type is neither application/json nor application/x-www-form-urlencoded.
  • 422 — invalid address or consent missing.
  • 429 — rate limit reached; Retry-After carries the seconds to wait.
  • 500 — unexpected server error.

Every error body is typed the same way, so one handler covers all of them. The token endpoint is the single exception and answers in the OAuth 2.0 format.

HTTP/1.1 422 Unprocessable Entity
{"error":"invalid_email","message":"The e-mail address is not valid."}

Authentication and permissions

The status probe and the waitlist need no authentication and grant none. The statistics endpoint is protected by OAuth 2.0 client credentials (RFC 6749 section 4.4) and accepts only a token carrying the scope waitlist:stats:read. That scope grants aggregate counts, never personal data.

  • Authorization server metadata (RFC 8414): the discovery document of the authorization server.
  • Protected resource metadata (RFC 9728): the discovery document of the API.
  • Token endpoint: https://www.authiane.com/api/v1/oauth/token, client authentication with HTTP Basic or with client_id and client_secret in the form body.
  • Tokens are HS256 JWTs valid for 15 minutes; there is no refresh token and no revocation list.
  • A rejected call carries a Bearer challenge in WWW-Authenticate with the error and the resource metadata.
  • Production clients are issued by Das Digitale Momentum on request; write to info@ddm-it.de.

Sandbox

The same contract is served under the base path /sandbox/api/v1 for testing. It stores nothing, returns fixed example statistics and accepts a public client, so an agent can exercise the whole protected flow without credentials.

token=$(curl -sS -u sandbox:sandbox -d grant_type=client_credentials \
  https://www.authiane.com/sandbox/api/v1/oauth/token | jq -r .access_token)
curl -sS -H "Authorization: Bearer $token" https://www.authiane.com/sandbox/api/v1/waitlist/stats

Versioning and rate limits

  • The major version is part of the path (/api/v1/). A breaking change appears only under a new major path.
  • Deprecated operations are flagged in the OpenAPI document and keep working; POST /api/waitlist is such an alias.
  • Every API response carries X-API-Version and the RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset and RateLimit-Policy headers.
  • The rate limits are 120 requests per minute per client for GET and HEAD on /api/v1/status and for every sandbox call, 30 for every other call. Each limit is counted per source address in its own window; a 429 carries Retry-After.
curl -sS https://www.authiane.com/api/v1/status

Notes for AI agents

  • Sources of truth for what Authiane is: the start page, the About page and this page. Nothing else on this site describes the platform.
  • Prefer Accept: text/markdown. Every page then answers with its Markdown twin at the same URL, and every twin is also reachable under its own .md address with a canonical Link header.
  • The machine-readable index is the llms.txt file; the page list is the XML sitemap.
  • Never submit an e-mail address without the explicit consent of its owner, and never invent one. The waitlist is the only write operation on this site.
  • There are no prices, no demo, no login and no platform API keys to find here. Asking for them returns a real 404, not a soft one.
  • Crawl politely: one client, sequential requests, and honour Retry-After after a 429.