Authentication

POST /api/auth/login/ stable

Get JWT access/refresh pair

POST /api/auth/refresh/ stable

Refresh access token

GET /api/user/profile/ stable

Current user profile

Releases

GET /api/releases/ stable

Release list

GET /api/releases/{id}/ stable

Release details

GET /api/stats/releases/{id}/ stable

Release statistics

Finance and Reports

GET /api/finance/summary/ stable

Balance and payout summary

GET /api/payouts/ stable

Payout history

GET /api/royalty-reports/ stable

Royalty reports

Authentication

  • All endpoints require either a valid Django session cookie or a JWT token in the Authorization: Bearer <token> header.
  • JWT tokens are issued via the desktop client login flow and expire after 24 hours by default.
  • Session-based access is restricted to the same origin; CORS is enabled only for approved client origins.

Rate limits & versioning

  • The API is versioned at v1. Breaking changes will be introduced under a new version prefix.
  • Rate limits are applied per account. Burst requests are throttled at 60 req/min for read endpoints.
  • All responses follow JSON:API conventions. Errors return {"error": "message", "code": 4xx}.