Public API reference

Programmatic access to everything the dashboard does: manage offers, generate tracking links, pull reports, process affiliate applications. Base URL: https://affilink.co.il. (Conversion reporting is a separate, HMAC-signed API - see the Postback API reference.)

Authentication

Authorization: Bearer afk_live_8a2f9c1e...

Creating keys: dashboard → "מפתחות API" section - owner/admin only, requires the Growth plan or higher. The full key is shown exactly once at creation; only a hash is stored.
Keys expire 30 days after creation (security default). An expired key fails with 401 exactly like a revoked one - rotate before expiry.
Org-level key: sees and manages everything in its organization.
Vendor-scoped key (created with a vendorId): sees and manages only that vendor's own offers and their performance - never other vendors' data or the affiliate roster.
Test mode (mode: "test"): everything a test key creates is flagged test data and excluded from real commission calculation and payouts.

Scopes

Scope	Grants
`read:offers` / `write:offers`	List/read offers · create and update offers (creation only - see next row)
`offers:approve`	Move an offer out of `pending_review`. Deliberately separate from `write:offers`, so a vendor key can create offers but never approve its own.
`read:tracking_links` / `write:tracking_links`	List an affiliate's links · generate new ones
`read:reports`	Clicks / conversions / payouts endpoints
`read:affiliates` / `write:affiliates`	Roster + applications · approve/reject applications
`read:vendors` / `write:vendors`	Org-level keys only - manage the vendor roster

Conventions

Errors - one envelope everywhere:

{ "error": { "code": "offer_not_found", "message": "No offer with that id in your scope." } }

Rate limiting - exceeding it returns 429; back off and retry.
Idempotency - retrying a failed POST is safe on endpoints with natural uniqueness (tracking links per affiliate+offer, applications per affiliate+offer); duplicates return 409 or the existing resource.

Offers

GET    /v1/offers                     read:offers
GET    /v1/offers/{id}                read:offers
POST   /v1/offers                     write:offers
PATCH  /v1/offers/{id}                write:offers   (status: pending_review | paused | archived only)
POST   /v1/offers/{id}/approve        offers:approve (pending_review -> active)
POST   /v1/offers/{id}/reject         offers:approve (pending_review -> draft, body: {"reason": "..."})

A vendor-scoped key creating an offer gets its vendorId set automatically and the offer starts in pending_review. The webhookSecret field is returned only to org owner/admin keys and to the offer's own vendor.

Tracking links

GET    /v1/tracking-links                        read:tracking_links
POST   /v1/tracking-links                        write:tracking_links
GET    /v1/tracking-links/{id}/clicks            read:reports

POST body: {"offerId": "off_...", "affiliateId": "..."} (affiliateId required for API-key calls; org keys can only create links for offers in their own org). The affiliate must have an approved application unless the offer has requiresApproval: 0 - the API enforces the same rule as the dashboard. Returns the link as https://go.affilink.co.il/r/{code}.

Reports

GET /v1/reports/clicks?offer_id=&affiliate_id=&sub1=     read:reports
GET /v1/reports/conversions?status=                       read:reports
GET /v1/reports/payouts?affiliate_id=&status=             read:reports

Vendor-scoped keys see the sale amounts they reported but not affiliate_commission_minor/platform_fee_minor - the fee breakdown isn't part of the vendor's business relationship.

Affiliates & applications

GET   /v1/affiliates                     read:affiliates
GET   /v1/affiliates/{id}                read:affiliates
GET   /v1/applications?status=pending    read:affiliates
POST  /v1/applications/{id}/approve      write:affiliates
POST  /v1/applications/{id}/reject       write:affiliates

Vendors

GET    /v1/vendors          read:vendors   (org-level keys only)
POST   /v1/vendors          write:vendors  (org-level keys only)
PATCH  /v1/vendors/{id}     write:vendors  (org-level keys only)
PATCH  /v1/vendors/me       write:offers   (vendor-scoped keys only)

PATCH /v1/vendors/me is the one vendor-side exception: it lets a vendor update their own feedUrl/feedFormat without the roster-wide write:vendors scope, and can't be pointed at any other vendor's record.

Dashboard-session alternative

Every /v1/* endpoint also accepts a logged-in dashboard session (cookie) plus an X-Org-Id header instead of a Bearer key - same scopes, derived from your role. Useful for quick testing from the browser's dev tools before minting a key.