REST API Reference

VibeView exposes a REST API for managing simulator sessions, apps, tests, organizations, and AI-powered test execution. All endpoints are served under the /api/v1/ prefix.

Base URL: https://<your-vibeview-host>/api/v1

Authentication

All endpoints (except registration, login, and the email-verification and password-reset endpoints) require a valid Bearer token in the Authorization header.

Authorization: Bearer <token>

Tokens are obtained via the login or registration endpoints. You can also create long-lived API tokens in your organization settings (see API tokens).

Resources

Each resource has its own page:

• Auth — register, log in, verify email, reset passwords
• Organizations — team members, API tokens, audit events, session defaults
• Apps — upload, list and delete app builds
• Sessions — create, control and stop simulator sessions, install apps
• Devices — list the device groups a session can request
• Tests — tests, groups (suites), runs and results
• AI — models, provider keys, AI test runs and usage
• Credits and usage — balance, top-ups, AI and streaming usage
• CI — trigger runs from a pipeline and poll their status

Error Responses

Error responses carry a detail field. For most errors it is a human-readable message:

{
  "detail": "Human-readable error message"
}

A 422 validation error is the exception: its detail is an array with one entry per invalid field. Each entry names the field’s location in loc (for example ["query", "limit"] or ["body", "device_type"]), explains the problem in msg, and gives a machine-readable type:

{
  "detail": [
    {
      "type": "less_than_equal",
      "loc": ["query", "limit"],
      "msg": "Input should be less than or equal to 200",
      "input": "500",
      "ctx": { "le": 200 }
    }
  ]
}

Handle both shapes: check whether detail is a string or an array before showing it.

Common HTTP status codes:

Rate Limits

API token usage is tracked per organization. Requests are rate-limited per client:

• Most endpoints: 100 requests/minute.
• App uploads and AI test runs (POST /api/v1/ai/test/run): 10 requests/minute.
• Auth endpoints (register, login, change-password): 5 requests/minute.

Exceeding a limit returns 429 Too Many Requests. AI test execution is additionally subject to upstream LLM provider rate limits.

Webhook Events

VibeView emits webhook events for tests, visual regressions, warnings, platform actions, and billing. Subscribe an endpoint to specific events under Settings → Integrations, or via the API:

• GET /api/v1/integrations/events/catalog — list every event type the system emits.
• GET/PUT /api/v1/integrations/webhooks/{id}/subscriptions — read or replace the event-type set for a webhook.
• POST /api/v1/integrations/webhooks/{id}/regenerate-secret — rotate the HMAC signing secret. The plaintext is returned once.
• GET /api/v1/integrations/webhooks/{id}/deliveries — last 30 days of delivery attempts, with payload and response excerpts.
• POST /api/v1/integrations/webhooks/{id}/deliveries/{delivery_id}/redeliver — redeliver a specific past event.

See Webhooks and Slack for the full event catalog, payload schemas for every event, and signing-verification snippets in Node.js, Python, and Go.