Your rights data, over HTTP.

Make a key in Settings → API. It is shown once and stored only as a hash, so a copy of our database cannot call the API as you. Send it as a bearer token.

curl https://snvrkotics.com/api/v1/recordings \
  -H "Authorization: Bearer snvrkotics_sk_…"

Every response is scoped to that key’s workspace. 120 requests a minute per key, with X-RateLimit-Remaining on every response and a 429 when you pass it. A key stops working the moment its workspace drops below Pro, so entitlement is checked on each call rather than at creation.

Paging

The lists answer up to limit rows (1 to 200, default 50) and a next value. Send it back as after for the following page; it is null on the last one. The cursor is a row id, not an offset, so a walk that runs while the catalog changes still returns each row once. The two summaries are totals over every row and come back whole, with next always null.

curl "https://snvrkotics.com/api/v1/recordings?limit=100" -H "Authorization: Bearer snvrkotics_sk_…"
# { "data": [ … 100 rows … ], "count": 100, "next": "6f1c…" }

curl "https://snvrkotics.com/api/v1/recordings?limit=100&after=6f1c…" -H "Authorization: Bearer snvrkotics_sk_…"
# … until "next": null

{ "id": "…", "source": "DistroKid", "lineCount": 603, "netCents": 165788, "periodStart": "2026-01-01", "periodEnd": "2026-06-30" }

{ "id": "…", "totalCents": 42000, "status": "draft", "periodStart": "2026-01-01", "periodEnd": "2026-06-30" }

{ "id": "…", "totalCents": 199106, "people": 3, "status": "final", "periodStart": "2026-04-01", "periodEnd": "2026-06-30", "finalizedAt": "2026-07-02T15:00:00.000Z" }

{ "id": "…", "slug": "night-bus", "title": "Night Bus", "url": "https://vance.nvr.to/night-bus" }

{ "shareId": "…", "recordingId": "…", "collaborator": "Deon Park", "everyPartyAccepted": false }

Verifying a delivery

Each request carries X-SNVRK-Signature: t=<unix seconds>,v1=<hex>. The signature is an HMAC-SHA256 over "<t>.<raw body>" using your signing secret. Compare in constant time, and reject anything older than five minutes so a captured delivery cannot be replayed.

import { createHmac, timingSafeEqual } from "node:crypto";

function verify(secret, rawBody, header) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const t = Number(parts.t);
  if (!Number.isFinite(t) || Math.abs(Date.now() / 1000 - t) > 300) return false;
  const expected = createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(parts.v1 ?? "");
  return a.length === b.length && timingSafeEqual(a, b);
}

Delivery, stated plainly

One attempt, with a five-second timeout, and the outcome is shown against the endpoint in settings. There is no retry queue, and we would rather say so than imply one: if a delivery matters, read the matching endpoint above to reconcile. Deliveries never block the thing that caused them, so an endpoint being down cannot fail an import.

Webhooks follow the same plan rule as keys. Endpoints are added on Pro and above; if a workspace drops below it, its endpoints stay in settings but nothing is sent to them, and each one says so, until the plan returns.