Skip to main content
BundleUp exposes five HTTP APIs. They share one API key per workspace. All requests must use HTTPS.

​
Authentication

Every API except the browser-facing /authorize takes your API key as a bearer token:
The Proxy, Unified API and MCP act on a specific connected account, so they also need:
See Authenticating API requests and the full headers reference.

​
Formats

  • Request and response bodies are JSON, except on the Proxy and MCP, which pass the provider’s formats through unchanged.
  • Timestamps are ISO 8601 strings in UTC, except webhookTimestamp in webhook payloads, which is milliseconds since the epoch.
  • IDs are opaque strings. Don’t parse them.

​
Pagination

  • Platform API: offset-based. offset (0 to 1,000) and limit (1 to 100, default 10). List endpoints return a JSON array.
  • Unified API: cursor-based. limit (1 to 100, default 100) and after, from the previous page’s metadata.next. See Conventions.

​
Errors

Each API returns errors in its own format, and the Proxy, Unified API and MCP also pass provider errors through. See the errors reference.

​
Versioning

The Platform API and Unified API are versioned in the path (/v1). Backward-incompatible changes get a new major version. New endpoints and new response fields can be added within a version, so ignore fields you don’t recognize. The Proxy and MCP aren’t versioned: they mirror whatever the provider’s API or MCP server offers.
The Platform API is still evolving. Public endpoints aren’t expected to change much, but treat it as a draft.

​
OpenAPI specs

The Platform API and Unified API reference pages are generated from their OpenAPI specs, which you can also use to generate clients: