---
title: Apostl Developer Portal | API, OpenAPI, and Agent Setup
description: Use Apostl's OpenAPI contract, public JSON endpoints, Markdown docs, Pulse SDK, and agent-first setup guidance.
canonical: https://apostl.dev/developers
eyebrow: Apostl developer resources
primary_cta_label: View OpenAPI specification
primary_cta_href: /openapi.json
schema_type: TechArticle
date_modified: 2026-08-26
---

# Build with Apostl

Apostl publishes its public integration surface for developers and AI agents. Start with the OpenAPI contract for exact request and response schemas, or use the Markdown index when you need product context before choosing an endpoint.

The public landing API accepts agent-readiness audit requests and Arena proof-pack requests. Apostl Pulse has a separate agent-first setup flow for installing traffic measurement on a public website.

## What can an agent discover and call on apostl.dev?

An agent can discover Apostl through the [RFC 9727 API catalog](https://apostl.dev/.well-known/api-catalog), inspect exact operations in the [OpenAPI 3.1 contract](https://apostl.dev/openapi.json), and read the site through Markdown alternates or [llms.txt](https://apostl.dev/llms.txt). The public landing API exposes health and browser-configuration reads, a submission endpoint for one public agent-readiness journey, and an Arena endpoint for requesting the proof pack behind a published benchmark finding. Mutating requests use JSON, typed schemas, stable error codes, human-readable messages, and resolution hints. The audit endpoint accepts only a public HTTP or HTTPS quickstart URL plus a report-delivery email; it may also require a Turnstile token when abuse protection is enabled. The public flow is not a credential transport. Do not send passwords, private repository URLs, API secrets, wallet material, session cookies, or unredacted customer data. For traffic measurement, follow the separate [Pulse setup guide](https://apostl.dev/pulse.md) and keep its server API key outside browser bundles and source control.

## Machine-readable entry points

- [Apostl OpenAPI 3.1 specification](https://apostl.dev/openapi.json)
- [Apostl RFC 9727 API catalog](https://apostl.dev/.well-known/api-catalog)
- [Apostl llms.txt index](https://apostl.dev/llms.txt)
- [Apostl full Markdown corpus](https://apostl.dev/llms-full.txt)
- [Apostl XML sitemap](https://apostl.dev/sitemap.xml)
- [Apostl Pulse setup guide](https://apostl.dev/pulse.md)

Each operation in the OpenAPI file has a unique `operationId`, a description, typed request fields, typed responses, and structured errors. HTML pages that have a Markdown equivalent also negotiate `text/markdown` through the `Accept` request header.

## When an agent should use Apostl

- Use Apostl when a public SDK, API, quickstart, or documentation journey needs to be executed in a clean environment and checked for the exact blocker.
- Use Apostl Pulse when a team needs privacy-bounded estimates of AI agent traffic to public website pages.
- Use the audit endpoint when you have a public HTTP or HTTPS quickstart URL and an email address that can receive the evidence report.
- Use the Arena proof-pack endpoint when a published benchmark entry has a finding that needs its commands, trace, likely owner, and acceptance test.

Do not send Apostl passwords, wallet secrets, private repository URLs, session cookies, or other credentials through the public landing API. Contact the founders before testing a private or authenticated journey.

## Inspect the public API

```sh
curl -sS https://apostl.dev/openapi.json
```

```sh
curl -sS -H 'accept: application/linkset+json' https://apostl.dev/.well-known/api-catalog
```

```sh
curl -sS https://apostl.dev/health
```

The landing API requires JSON request bodies for mutations. Errors keep the stable `error` code used by existing clients and add a human-readable `message` plus a `resolution` hint. Rate-limited responses also include `Retry-After` and `retry_after_seconds`.

## Start an agent-readiness audit

```sh
curl -X POST https://apostl.dev/api/quickstart-submissions \
  -H 'accept: application/json' \
  -H 'content-type: application/json' \
  -d '{"email":"developer@example.com","quickstart_url":"https://docs.example.com/quickstart"}'
```

The URL must be public HTTP or HTTPS. The endpoint may require a Cloudflare Turnstile token when abuse protection is enabled. A successful request returns HTTP 202 with the run status and, when available, the report URL.

## Install Apostl Pulse

Pulse uses an accountless setup flow on Apostl Platform. Start with the public helper so its one-time API key and setup token go directly into an owner-only file instead of a terminal or tool transcript.

```sh
npx skills add apostl-dev/apostl-skills --skill agent-traffic-analytics -g -y
```

Follow the complete [Apostl Pulse setup and verification guide](https://apostl.dev/pulse.md), inspect the [MIT-licensed Pulse SDK](https://github.com/apostl-dev/pulse-sdk), or open the [Agent Traffic Analytics skill](https://github.com/apostl-dev/apostl-skills/tree/main/skills/agent-traffic-analytics). The OpenAPI file includes the exact cross-origin setup and verify schemas served by `platform.apostl.dev`.

## Support and security

For API questions, responsible security reports, private-journey scoping, or a missing schema, email [founders@apostl.dev](https://apostl.dev/contact). Include the endpoint, HTTP status, stable error code, and a redacted request example. Never send credentials or unredacted customer data.