Skip to main content
The Elastly API serves explainable prices, ingests your canonical data, and hands back approved price write-backs. Every endpoint is documented on its own page with a live playground. This page covers what is true across all of them. The base URL is https://app.elastly.io. There is no separate sandbox host; you scope access with keys instead.

​
Authentication

Every request carries a workspace API key as a bearer token. Keys are prefixed elastly_live_ and are created and revoked under Settings → API keys in the dashboard. A key is shown once at creation, so store it somewhere safe.
Scopes are separate on purpose, so a key can do exactly one job: A serving key can never write your catalog, and a connector key can never read prices. Use a separate key per environment so you can rotate one without touching the other.
Treat a key like a password. Never expose an elastly_live_ key in client-side code. If a key leaks, revoke it in the dashboard and issue a new one.

​
Rate limits

Price serving is rate-limited per workspace with a token bucket: roughly 100 requests every 10 seconds sustained, bursting to 120. A rep adding lines fires a short burst well under the ceiling; sustained abuse is capped at the refill rate. Exceeding the limit returns 429 with a Retry-After, so back off when you see it. When the limiter itself is unreachable it fails open, so pricing is never blocked by the limiter.

​
Errors

Elastly uses conventional HTTP status codes. 2xx is success, 4xx a problem with your request, and 5xx a rare error on our side. Every error body includes a machine-readable message. Money is always integer cents. The engine never does floating-point math on money, and neither should you when you read a response.

​
Idempotency

Every mutating call takes an Idempotency-Key. Use a fresh key for each logical request, and reuse the same key when you retry, so a retried call is served from the stored response and never acts twice. The SDKs set this for you.

​
Webhooks

Subscribe an endpoint under Settings → Webhooks and Elastly POSTs a signed JSON payload when something happens. There are four event types:

​
Verifying the signature

Each delivery carries an elastly-signature header in the form t=<unix>,v1=<hmac>, where the HMAC is SHA-256 over the string <t>.<body> keyed with your endpoint’s signing secret (prefixed whsec_). Recompute it to confirm authenticity, and reject deliveries whose timestamp is outside your tolerance to guard against replays.
The TypeScript SDK verifies this for you in one call.

​
Versioning

The API is versioned in the URL: every endpoint lives under /api/v1. A new major version would live at a new path, so an integration pinned to /api/v1 keeps working unchanged. The SDKs bind their major version to the API version, so an upgrade within a major is always safe.