API
Reach it from your own code.
A key, a bearer header, and the endpoints the dashboard itself runs on. What is missing is written down further down this page, in the same detail.
One key, shown once.
Create a key in Settings → API keys, give it a name you will recognise in six months, and copy it — there is no route that reads a key back.
Keys begin utmk_, so a leaked one is recognisable as ours by a scanner or a person. Each records when it was last used, which is how you tell a live integration from one you have forgotten about. Revoke or expire any of them without touching the others.
curl https://app.utmcap.com/api/v1/stats/overview \
-H "Authorization: Bearer utmk_…"Every endpoint below answers on app.utmcap.com/api and is scoped to the account the key belongs to.
What you can call
The endpoints the dashboard uses.
Not a reduced, second-class surface built for outsiders — the same routes the product runs on, which is why they are maintained.
Campaigns and routing
Read and write campaigns, their flow, and the rules that decide where a click goes.
/v1/campaigns/v1/campaigns/{id}/flow/v1/rules/v1/tools/routing
Reporting
The same figures the dashboard draws: an overview, a time series, breakdowns by any dimension, and the export queue.
/v1/stats/overview/v1/stats/timeseries/v1/stats/breakdown/v1/reports/performance/v1/reports/exports
Offers, landers and sources
The objects a campaign is assembled from, including affiliate networks and their integration settings.
/v1/offers/v1/networks/v1/traffic-sources/v1/short-links
Domains
Add a tracking domain, check where it points, and ask for its certificate.
/v1/domains/v1/domains/{id}/verify/v1/domains/{id}/certificate
Account
Your plan and usage, the team, alerts, and the bot-detection settings.
/v1/plan/v1/team/v1/alerts/v1/bot-detection/v1/settings
Corrections
Repair a conversion that never arrived, or a cost that came through wrong.
/v1/corrections/conversions/v1/corrections/cost
Without a key
Three things that need no credential at all.
These are the integration points most people actually use, and none of them involves an API key.
Conversion postback
A server-to-server call from your network or your own checkout, carrying the click id, the payout and a status. The reply says plainly what happened — including click_not_found and bad_secret, rather than a silent 200.
The measurement tag
One script on your landing page. It ties the page view, and anything you mark as a goal, back to the click that paid for it.
The protection script
For pages that make their own decisions — a PHP lander that needs the click id server-side before it renders anything.
All three are written up in the documentation, with the parameters and what each reply means.
Not there yet
What to know before you build against it.
An API page that lists only the endpoints leaves you to discover the rest at the worst moment. These four are the ones that would change how you plan an integration.
A published reference
There is no API documentation on docs.utmcap.com yet, and no OpenAPI file. Today the honest answer is: open the network tab in the dashboard, or ask us and we will send you the shape of the call you need.
Per-key scopes
A key carries the whole account’s access. There is no read-only key and no key limited to one campaign, so treat a key as you would a password and give it its own name so you can revoke exactly one integration.
A frozen contract
These are the routes the dashboard uses, which is why they exist and are maintained — and also why their shapes can move. Nothing is contract-frozen under a version guarantee yet.
Webhooks out
Nothing leaves on an event. Conversions come in by postback; there is no outbound call when a click, a conversion or a limit happens.
Building something against it? Tell us what you need — what people are actually calling decides what gets documented and frozen first. The platforms we already speak to are on the supported platforms page.
Point a domain at us and run a click through it.
The free plan takes ten thousand clicks a month and no card. If it does not do what you need, you have lost twenty minutes.