Docs

Everything the dashboard does, the API does. Create links, read analytics, manage domains and QR codes. 32 operations, and a key you can issue yourself.

Full API reference

Sections

Base URL
Authentication
Your first link
Analytics
Responses and errors
Rate limits
Webhooks
What you can call
Limits and support

Base URL

base-url

https://trimly-api.fly.dev/api/v1

Every path below is relative to it. Only HTTPS is served.

Authentication

Create a key in the dashboard under Settings → API and send it on every request:

authenticated-request.sh

curl https://trimly-api.fly.dev/api/v1/links \
  -H "X-API-Key: trm_live_xxxxxxxxxxxx"

A key belongs to one workspace and carries that workspace's permissions.

A key is shown once

The value appears only at the moment you create it and cannot be read back afterwards. Store it somewhere you can retrieve it before closing the dialog.

The dashboard authenticates differently

It uses a short-lived bearer token and an httpOnly refresh cookie. That path is not intended for machine clients.

Your first link

create-link.sh

curl -X POST https://trimly-api.fly.dev/api/v1/links \
  -H "X-API-Key: trm_live_xxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{"destinationUrl": "https://example.com/a-long-url"}'

Everything but destinationUrl is optional. Pass slug for a custom alias, domainId to serve it from one of your own domains, or password, expiresAt and clickLimit to restrict it.

Analytics

Every link tracks clicks from the moment it's created:

link-analytics.sh

curl "https://trimly-api.fly.dev/api/v1/analytics/overview?linkId={id}&range=7d" \
  -H "X-API-Key: trm_live_xxxxxxxxxxxx"

analytics-response.json

{
  "success": true,
  "data": {
    "summary": { "totalClicks": 146, "uniqueVisitors": 98 },
    "timeseries": [
      { "bucket": "2026-08-19", "clicks": 12, "uniques": 9 },
      { "bucket": "2026-08-20", "clicks": 18, "uniques": 14 }
      … one entry per day in range
    ]
    … countries, cities, devices, browsers, heatmap
  }
}

Charted, timeseries is the same shape the dashboard renders:

response.data.timeseries → clicks

linkId is optional — omit it for the workspace-wide overview. range accepts 24h, 7d, 30d, 90d, 12m or all. Unique visitors are counted with a daily-rotating hash, so the number is real without storing anyone's IP address.

Responses and errors

Every response has the same shape. Failures carry a code and a request id:

error-response.json

{
  "success": false,
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Validation failed",
    "requestId": "98a9b9dc-a27e-4672-8271-b6e33a65d448"
  }
}

Quote the request id when reporting a problem

It is logged server-side and identifies the exact request, which is usually the difference between a reproducible report and a guess.

Rate limits

Every response carries the current state of your limit:

response-headers.http

RateLimit-Limit: 120
RateLimit-Remaining: 118
RateLimit-Reset: 42

Exceeding it returns 429. Authentication endpoints are limited far more tightly than the rest.

Webhooks

Rather than polling, register a webhook and receive events as they happen: a link created, a domain verified, a member joining. Deliveries are retried and logged, and the log is kept for 30 days.

What you can call

Links: list, create, read, update, delete, bulk delete, export, import
Analytics: overview, top links, export
QR codes: list, create, download
Domains: list, add, verify
Organization: collections, tags
Workspace: members, activity
Developer: API keys, webhooks
Billing: plans, usage

Each one, with its parameters, request bodies and response schemas, is in the reference, which you can call directly from the page once you paste in a key. The OpenAPI document itself is at /openapi.json if you would rather generate a client.

Limits and support

Rate limits and quotas depend on your plan; the numbers are on the pricing page. Security issues go to the address on the security page.