API and webhooks

Everything the dashboard does is available with a key. The generated reference lists every endpoint.

Authentication

curl https://glboost.com/api/v1/assets \
  -H "Authorization: Bearer glb_live_xxxxxxxx_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

Create keys in Settings (Pro). A key has read and/or write scopes and can be pinned to a project. Keys are stored hashed; the dashboard shows the value once. Each key has a token bucket of 120 requests refilling at 2 per second; over the limit you get 429 with Retry-After.

Uploading

POST /api/v1/uploads            { projectId, filename, bytes }   → { assetId, versionId, uploadUrl }
PUT  <uploadUrl>                 the file bytes
POST /api/v1/uploads/:versionId/complete                        → variants queued

Then poll GET /api/v1/assets/:id or wait for the variant.ready webhook. Replace a model by passing assetId to the first call.

Main endpoints

/assets, /assets/:id: List, read, update (name, visibility, viewer settings, hotspots), delete.
/assets/:id/variants: Request a variant by spec or by { budgetBytes, target }.
/assets/:id/compat, /exports: Compatibility report; glTF zip and C header exports.
/assets/:id/sign: Mint a signed URL for a private asset.
/assets/:id/comments, /comments/:id: Read and post comments; resolve or delete.
/shares, /shares/:id, /shares/:id/events: Share links for an asset or collection and their audit log.
/collections, /collections/:id: Create, order, and delete collections.
/environments: Upload and list custom environment maps.
/usage: Rolled-up usage, live delivery stats, and share activity.
/keys, /webhooks: Manage keys and webhooks (dashboard session only).

Plan limits answer 402 with { error, plan, used, limit, upgradeUrl }; file size limits answer 413.

Webhooks

Register an https URL in Settings with the events you want: asset.ready, variant.ready, variant.failed, share.viewed, share.downloaded, comment.created. Deliveries are JSON { id, event, createdAt, data } and are retried with backoff (1 minute to 12 hours, six attempts).

X-GLBoost-Signature: t=1760000000,v1=<hex hmac-sha256(secret, t + "." + body)>

Verify by recomputing the HMAC over t.body with the webhook secret and comparing in constant time; reject timestamps older than a few minutes.

The full reference with schemas is at /docs/api and as OpenAPI JSON.