Owlat Docs

Public Endpoints

These routes are public-facing and usually accessed from email links or embedded forms.

These routes are public-facing and usually accessed from email links or embedded forms.

Health check

  • GET /api/v1/health

Tracking

  • GET /t/o/:emailSendId (open pixel)
  • GET /t/c/:emailSendId/:encodedUrl (click redirect + tracking)

Unsubscribe

  • POST /unsub/:token (RFC 8058 one-click unsubscribe)
  • GET /unsub/verify/:token (validate token and fetch page context)

Preference center

  • GET /prefs/verify/:token
  • POST /prefs/update/:token

List double opt-in

  • GET /confirm/list/verify?token=...
  • POST /confirm/list?token=...

Form submission

  • POST /forms/:formId

Campaign archive

  • GET /archive/:token — returns the archived HTML snapshot of a sent campaign

Public-facing endpoint for "View in Browser" links. Returns the campaign content as it appeared at send time.

Response:

{
  "html": "<html>...</html>",
  "subject": "Our biggest sale of the year",
  "sentAt": "2026-03-10T14:30:00Z",
  "organizationName": "Acme Inc."
}

The archive token is unique per campaign and included in the email's "View in Browser" link. Archive endpoints are rate limited and CORS enabled.

Notes

  • CORS is enabled where required for browser-based flows
  • Public endpoints are rate-limited by IP
  • Tokenized endpoints return structured JSON for invalid/expired tokens
Next Authentication