HTTP API - Stout

The Stout dashboard uses the Stout HTTP API. You can call the same API from your own scripts.

Base URL

https://api.stoutdata.ai

API routes start with /api/. On a standalone install, use the API address of your install.

Authenticate

The API uses bearer access tokens. To get a token, sign in with the email and the password of a Stout account:

curl -s -c cookies.txt \
  -H 'Content-Type: application/json' \
  -d '{"email": "alice@example.com", "password": "YOUR_PASSWORD"}' \
  https://api.stoutdata.ai/api/auth/login

The response body contains accessToken. Send the token in the Authorization header of each request:

curl -s -H "Authorization: Bearer $ACCESS_TOKEN" \
  https://api.stoutdata.ai/api/orgs/me

GET /api/orgs/me lists the organizations that you belong to, with the ID of each organization. The routes for one organization contain that ID, for example /api/orgs/<orgId>/members.

An account that signs in only through SSO has no Stout password, so it cannot use POST /api/auth/login. For a script, use an account that has a password.

Token lifetimes

An access token expires after 15 minutes.
The sign-in response also sets a refresh token in the stout_refresh_token cookie. The refresh token lasts 7 days.
To get a new access token, send POST /api/auth/refresh with that cookie. Stout returns a new access token, and it replaces the refresh token.
If a refresh token comes back more than 30 seconds after Stout replaced it, Stout ends that session.
When you change or reset your password, Stout ends all of your other sessions.

curl -s -b cookies.txt -c cookies.txt -X POST \
  https://api.stoutdata.ai/api/auth/refresh

Permissions

The API applies the same roles as the dashboard. A request to an organization that you do not belong to returns status 403. When a member sends a request that needs an owner or admin, the API returns status 403. See Roles and permissions. Boxes and CI systems do not use these tokens. Each box uses its own API key, which Stout creates when it installs on the box. A CI system sends its results with a CI key. See CI Metrics.

Rate limits

Stout lets each caller send 300 requests per minute. For a request with a valid access token, the limit applies to the user. For a box, the limit applies to its API key. For any other request, the limit applies to the IP address. Some sign-in routes have lower limits:

Route	Limit
`POST /api/auth/login`	10 per minute
`POST /api/auth/refresh`	30 per minute
`POST /api/auth/forgot-password`	5 per 15 minutes
`POST /api/auth/password-reset/:token`	5 per minute
`POST /api/auth/invitations/:token/accept`	5 per minute
`POST /api/auth/change-password`	5 per hour
`POST /api/auth/resend-verification`	3 per hour

A request over a limit returns status 429. After 10 failed sign-ins for one email, Stout also locks that account until 15 minutes after the first failure. During the lock, POST /api/auth/login returns status 429 with a Retry-After header.

Errors

An error response has a JSON body with an error field that describes the problem:

{ "error": "Insufficient permissions" }

A request with fields that are not valid returns status 400. The fields list names each field that failed:

{ "error": "Validation error", "fields": ["email"] }

Status	Meaning
400	The request body or a parameter is not valid.
401	The access token is absent, not valid, or expired.
403	You do not have permission for this organization or this action.
404	The resource does not exist.
409	The request conflicts with existing data, for example an email that another account uses.
429	You sent too many requests, or failed sign-ins locked the account.
500	The server had an error.

Health check

GET /healthz returns status 200 when the API is available. It needs no token:

{ "status": "ok", "timestamp": "2026-09-11T19:06:54.585Z" }

​Base URL

​Authenticate

​Token lifetimes

​Permissions

​Rate limits

​Errors

​Health check

Base URL

Authenticate

Token lifetimes

Permissions

Rate limits

Errors

Health check