Skip to main content
Build, test, and run live traffic against production. You isolate development from production data using test chips rather than a separate host.

​
Base URL

Send your requests to production unless your Endstate contact has set you up on staging. Staging runs separate data and separate credentials, so a production API key will not authenticate there. There is no flag or header to switch behavior on a given host. What differs is whether you work with test chips or encoded hardware chips.

​
Developing without hardware

You can exercise the full tap flow before you have physical chips. Pair a test chip with POST /v1/chips (is_test: true), generate a fresh single-use e value with POST /v1/test-helpers/taps, then exchange it for a session token with POST /v1/taps. Test chips behave identically to encoded chips in every API call. See Testing without hardware for a step-by-step walkthrough.

​
HTTPS

HTTPS is required. Plain HTTP requests return 426 Upgrade Required.

​
OpenAPI spec

The OpenAPI specification is served at https://api2.endstate.io/openapi.json.

​
Credentials and limits

Your API key and your organization’s network configuration are set up by Endstate during onboarding - see Organization settings for what you can read and change yourself. Confirm any rate limits with your Endstate contact. If you plan to call the API from a browser, two things are self-serve: your publishable key and your CORS origins.

​
Next steps

Quickstart

Make your first API call end to end.

Credentials

Learn how API keys and session tokens work.