API Reference

This page covers how to authenticate and what the ingest endpoint accepts. The SDK pages describe the same payload from the client side.

Base URL

https://server.nolax.net

Authentication

All routes except POST /ingest authenticate with httpOnly cookies set at login: nolax_access_token and nolax_refresh_token. Send them with each request:

curl https://server.nolax.net/auth/me \
	--cookie "nolax_access_token=<your-access-token>"

Every non-GET request that carries these cookies must also send X-Requested-With: nolax-web, as the Nolax web app does. If the request has an Origin header, it must be an allowed origin. Otherwise the server answers 403 with code: "CSRF_REQUIRED". POST /ingest is exempt because it uses an API key.

POST /ingest authenticates with the project API key in the X-Nolax-Key header instead:

curl -X POST https://server.nolax.net/ingest \
	-H "X-Nolax-Key: nlx_proj_xxxxxxxxxxxx" \
	-H "Content-Type: application/json" \
	-H "Content-Encoding: gzip" \
	--data-binary @payload.json.gz

Ingest contract

The full request, limits and responses are on the Ingest Contract page. In short:

POST /ingest
X-Nolax-Key: nlx_proj_xxxxxxxxxxxx
Content-Type: application/json
Content-Encoding: gzip

{
	"environment": "production",
	"events": [
		{
			"method": "GET",
			"path": "/api/users",
			"statusCode": 200,
			"responseTime": 142,
			"payloadSize": 1024,
			"ip": "203.0.113.1",
			"userAgent": "MyApp/1.0",
			"timestamp": "2026-03-19T10:30:00.000Z"
		}
	]
}

The server replies 202 Accepted.

Response shape

Responses use one of these shapes:

Copy
{ "data": { /* resource payload */ }, "message": "optional" }

Full endpoint reference

A full endpoint reference is not published yet. Until it is, the source routes in the nolax-api repository are the reference.