Base URL
Authentication
Send your publishable key (vak_pub_…) in the X-API-Key header, or as Authorization: Bearer <key>. Reads need the catalog:read scope, POST /leads needs leads:write; dashboard keys have both. See Keys and websites.
Conventions
- Responses are JSON with
snake_casefield names.POST /leadstakes a JSON body. - Fields documented as nullable are always present, with
nullwhen there is no value. - Timestamps are ISO-8601 in UTC, e.g.
2026-09-22T09:05:02.499Z. - Prices are numbers in major units (
251.0is ₹251) with an ISO 4217currency. - Ids are opaque strings (currently UUIDs). Learning paths use a short
code. *_htmlfields are sanitised HTML;*_textfields are plain text.- Every response has an
X-Request-Idheader. Errors share one shape. - Successful reads are cacheable for 60 seconds. See Rate limits and caching.
Endpoints
If the in-page playground answers
403 origin_not_allowed, it is calling from your browser on this docs site, which is not one of your verified websites. Run the generated curl command instead.