API and webhooks

Everything the dashboard does is available with a key. The generated reference lists every endpoint.

Authentication

curl https://glboost.com/api/v1/assets \
  -H "Authorization: Bearer glb_live_xxxxxxxx_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

Create keys in Settings (Pro). A key has read and/or write scopes and can be pinned to a project. Keys are stored hashed; the dashboard shows the value once. Each key has a token bucket of 120 requests refilling at 2 per second; over the limit you get 429 with Retry-After.

Prefer not to hand-roll requests? @glboost/sdk types every endpoint from this document and adds uploadModel, waitForReady, and signUrl; the glboost CLI wraps it for scripts and CI. See SDK and CLI.

Uploading

POST /api/v1/uploads            { projectId, filename, bytes }   → { assetId, versionId, uploadUrl }
PUT  <uploadUrl>                 the file bytes
POST /api/v1/uploads/:versionId/complete                        → variants queued

Then poll GET /api/v1/assets/:id or wait for the variant.ready webhook. Replace a model by passing assetId to the first call.

Main endpoints

/me: Who the key or session is: the org and plan, the active project, the key name and scopes.
/assets, /assets/:id, /assets/:id/restore: List and search (q, tag, deleted=true for the trash); read; update (name, visibility, viewer settings, hotspots, tags, projectId to move); delete to the trash, then ?permanent=1 to purge; restore.
/assets/:id/versions/:versionId, …/reviews: Version notes; review decisions (approve / request changes) that publish the version under the project's publish-on-approval mode.
/assets/:id/thumbnail, …/thumbnail/render: Upload a captured poster, or render the poster and the 1200 × 630 og image in a headless browser.
/projects, /projects/:id: List, create (Pro and up), update delivery settings and publish-on-approval, delete empty projects. Org-wide keys pick the project with the X-GLBoost-Project header.
/assets/:id/variants: Request a variant by spec or by { budgetBytes, target }.
/assets/:id/compat, /exports: Compatibility report; glTF zip and C header exports.
/assets/:id/sign: Mint a signed URL for a private asset.
/assets/:id/comments, /comments/:id: Read and post comments; resolve or delete.
/shares, /shares/:id, /shares/:id/events: Share links for an asset or collection and their audit log.
/collections, /collections/:id: Create, order, and delete collections.
/environments: Upload and list custom environment maps.
/usage: Rolled-up usage, live delivery stats, and share activity.
/keys, /webhooks: Manage keys and webhooks (dashboard session only).
/billing/checkout, /billing/portal, /billing/switch-interval: Start a Checkout (monthly or yearly), open the Customer Portal, switch the billing interval (owners, dashboard session only).

Plan limits answer 402 with { error, plan, used, limit, upgradeUrl }; file size limits answer 413.

Webhooks

Register an https URL in Settings with the events you want: asset.ready, variant.ready, variant.failed, share.viewed, share.downloaded, comment.created, version.approved, version.changes_requested, usage.threshold (80% and 100% of a plan allowance, once per metric and month). Deliveries are JSON { id, event, createdAt, data } and are retried with backoff (1 minute to 12 hours, six attempts).

X-GLBoost-Signature: t=1760000000,v1=<hex hmac-sha256(secret, t + "." + body)>

Verify by recomputing the HMAC over t.body with the webhook secret and comparing in constant time; reject timestamps older than a few minutes.

The full reference with schemas is at /docs/api and as OpenAPI JSON.