Get started

API reference

The Tracee REST API: base URL, authentication, conventions and the OpenAPI document.

Base URL
https://traceeai.com/api/v1

Every page in this reference is generated from the API's OpenAPI 3.1 document, the same one the server enforces. Each endpoint shows its CLI command, its SDK call and the MCP tool action it matches, and has a playground: add your key under Authorization and send a real request.

Conventions

  • Authentication: Authorization: Bearer <key> on every request. See Authentication.
  • JSON in and out (application/json), except media uploads (multipart/form-data). Bodies up to 1 MB.
  • Field names: endpoints that run an MCP tool action use the tool's names (snake_case, like scheduled_for); the posts, media, channels, approvals and performance endpoints use camelCase.
  • Unknown fields are refused with 400, and the message lists the fields the endpoint takes.
  • Lists in a query string: comma-separated or repeated (channel_ids=a,b).
  • Times: ISO 8601 with an offset (2026-11-20T09:00:00Z).
  • Status codes: 200 done, 201 created, 202 started or still running (see Background jobs), errors as in Errors.
  • CORS is open: keys are bearer tokens, never cookies.

Sections