REST API

The Postlyra REST API lives at https://api.postlyra.com. It is a JSON API authenticated with a bearer token.

It covers account and brand management, media, members, subscription state, the idea import surface the CLI uses, and a versioned posts API (/v1) for creating and scheduling content from an outside tool. Nothing it does skips the approval rule: a scheduled publication only goes out once a human, or a call you have explicitly told can act as one, approves the post. See Posts and Approve and schedule.

Base URL

https://api.postlyra.com

Both https://api.postlyra.com/auth/me and https://api.postlyra.com/api/auth/me resolve. The unprefixed form is canonical, the prefixed one is a fallback that keeps local installs working.

A first call

curl https://api.postlyra.com/auth/me \
  -H "Authorization: Bearer $POSTLYRA_TOKEN" \
  -H "Accept: application/json"

{
  "user": { "id": 1, "name": "Ada Lovelace", "email": "ada@example.com" },
  "teams": [{ "id": 1, "name": "My Brand", "slug": "0f8fad5b-d9cb-469f-a165-70867728950e" }],
  "current_team": { "id": 1, "name": "My Brand" }
}

See Authentication for how to get $POSTLYRA_TOKEN.

What you need to know

• Authentication: create a token, and the login flow if you want to mint one programmatically.
• Choosing a brand: one token reaches every brand you belong to, so most endpoints need to know which one you mean.
• Errors: including one status-code quirk that will bite you if you do not know about it.
• Rate limits: what is throttled and what is not.
• Endpoint index: every route, generated from the router.
• Posts: create, schedule and check on posts from an outside tool.

What is not here

Most events have no webhook yet. Outgoing webhooks exist for five post events (published, failed, expired, approved, commented). A DM arriving, a metrics sync finishing, anything outside that list still has to be polled.

Your profile token carries full account access; a narrower one is available. The token from your profile is unscoped. Settings → API can also mint a token limited to one access tier (read, standard write, or elevated write, the same tiers an MCP connection consents to) for an integration you want to trust less.

Publishing still needs an approval, always audited to a person. Posts can create, schedule and even approve content by API, but approve: true only ever records YOUR account as the approver, and there is no way to publish the instant the call returns: it still goes out through the ordinary queue, at its scheduled time. For anything simpler, push ideas instead and let a human write and approve the draft in Studio.