Skip to main content
TRW
Skip to content
TRWREST API Reference

Docs

API reference

This page covers the hosted TRW platform API. You do not need these endpoints for the day-to-day repo-local workflow itself; use them when you are integrating auth, telemetry, releases, or other hosted surfaces. All backend routes are prefixed with /v1.

Base URL: https://api.trwframework.com/v1

How access works

Most operational routes are organization-scoped and authenticated with a platform API key. Public auth and onboarding endpoints stay open, but the data-bearing routes assume approved hosted access.

Public routes - Used for health checks, access requests, contact, and sign-in or verification flows. These routes do not require a bearer token.
API key routes - Used for telemetry, learnings, installations, and releases after access has been approved. Pass the key as Authorization: Bearer trw_live_...
Full-auth routes - Used for signed-in account flows such as email login and 2FA management. Exchange an API key for a short-lived JWT via POST /auth/token when you need one.
JWT bearer tokens - returned by email login or token exchange when a browser or signed-in dashboard flow needs them.Authorization: Bearer <token>
Important: The local source-available framework uses its own MCP tool surface. This REST API is for the hosted platform and synchronized org features.

Auth badges

Each endpoint shows one of three auth badges:

BadgeMeaning
publicNo bearer credential required.
api-keyRequires a platform API key scoped to one organization.
full-authRequires a signed-in user session or JWT-backed auth context.

Authentication

Account creation, sign-in, email verification, password reset, and 2FA flows.

Browse each endpoint below. Expand an endpoint for request and response details.

Public routes

Hosted-surface endpoints that do not require a bearer credential.

Browse each endpoint below. Expand an endpoint for request and response details.

Organization-scoped data

Telemetry, learnings, installations, and release-distribution routes authenticated with a platform API key.

Browse each endpoint below. Expand an endpoint for request and response details.

Releases

Release metadata and installer distribution routes used by hosted clients.

Browse each endpoint below. Expand an endpoint for request and response details.

Examples

Common API operations using curl.

Exchange API key for JWT
curl -X POST https://api.trwframework.com/v1/auth/token \
  -H "Content-Type: application/json" \
  -d '{"api_key": "trw_live_..."}'

# Response:
# { "access_token": "eyJ...", "token_type": "bearer" }
List learnings
curl https://api.trwframework.com/v1/learnings?page=1&page_size=10 \
  -H "Authorization: Bearer trw_live_..."

# Response:
# { "items": [...], "total": 342, "page": 1, "page_size": 10 }
Submit telemetry
curl -X POST https://api.trwframework.com/v1/telemetry \
  -H "Authorization: Bearer trw_live_..." \
  -H "Content-Type: application/json" \
  -d '{"events": [{"event_type": "session_start", "session_id": "run_123", "status": "ok"}]}'

# Response:
# { "accepted": 1 }

Rate limiting

All endpoints are rate-limited. When you exceed the limit, the API returns 429 Too Many Requests. Rate limit headers are included in every response:

X-RateLimit-Limit: 500
X-RateLimit-Remaining: 498
X-RateLimit-Reset: 1709200000

Error format

Application errors are normalized to a flat JSON shape with an error code, a human-readable detail string, and a request ID for correlation.

Error response
// 401 Unauthorized
{
  "error": "unauthorized",
  "detail": "Invalid or expired token",
  "request_id": "3a8f7f52-..."
}

// 404 Not Found
{
  "error": "not_found",
  "detail": "Learning not found",
  "request_id": "6f4f1b9c-..."
}

// 500 Internal Server Error
{
  "error": "internal_server_error",
  "detail": "An unexpected error occurred.",
  "request_id": "d2a0ab21-..."
}

Where to go next

Read configuration if you are wiring a repo install to the hosted platform. Read troubleshooting for auth, proxy, or environment issues. Read tools if your real integration surface is MCP rather than REST.

Next

Use configuration to point clients at the right endpoints, then use troubleshooting guidance when auth, proxying, or connectivity misbehaves.