REST API Reference

VibeView exposes a REST API for managing simulator sessions, apps, tests, organizations, and AI-powered test execution. All endpoints are served under the /api/v1/ prefix.

Base URL: https://<your-vibeview-host>/api/v1

Authentication

All endpoints (except registration, login, and the email-verification and password-reset endpoints) require a valid Bearer token in the Authorization header.

Authorization: Bearer <token>

Tokens are obtained via the login or registration endpoints. You can also create long-lived API tokens in your organization settings (see API tokens).

Resources

Each resource has its own page:

• Auth — register, log in, verify email, reset passwords
• Organizations — team members, API tokens, audit events, session defaults
• Apps — upload, list and delete app builds
• Sessions — create, control and stop simulator sessions, install apps
• Devices — list the device groups a session can request
• Tests — suites, test cases, runs and results
• AI — models, provider keys, AI test runs and usage
• Credits and usage — balance, top-ups, AI and streaming usage
• CI — trigger runs from a pipeline and poll their status

Error Responses

All error responses follow a consistent format:

{
  "detail": "Human-readable error message"
}

Common HTTP status codes:

Rate Limits

API token usage is tracked per organization. Requests are rate-limited per client:

• Most endpoints: 100 requests/minute.
• App uploads and AI test runs (POST /api/v1/ai/test/run): 10 requests/minute.
• Auth endpoints (register, login, change-password): 5 requests/minute.

Exceeding a limit returns 429 Too Many Requests. AI test execution is additionally subject to upstream LLM provider rate limits.

Webhook Events

VibeView emits webhook events for tests, visual regressions, warnings, platform actions, and billing. Subscribe an endpoint to specific events under Settings → Integrations, or via the API:

• GET /api/v1/integrations/events/catalog — list every event type the system emits.
• GET/PUT /api/v1/integrations/webhooks/{id}/subscriptions — read or replace the event-type set for a webhook.
• POST /api/v1/integrations/webhooks/{id}/regenerate-secret — rotate the HMAC signing secret. The plaintext is returned once.
• GET /api/v1/integrations/webhooks/{id}/deliveries — last 30 days of delivery attempts, with payload and response excerpts.
• POST /api/v1/integrations/webhooks/{id}/deliveries/{delivery_id}/redeliver — redeliver a specific past event.

See Webhooks and Slack for the full event catalog, payload schemas for every event, and signing-verification snippets in Node.js, Python, and Go.