Watchtower API
The Watchtower API has one job today: adding someone to the early access waitlist. It needs no sign-up and no API key. The machine-readable contract is the OpenAPI 3.1 spec. For using the Watchtower product itself, see the product documentation.
Quickstart
Send the email address as JSON. Only submit an address with its owner's consent; we email that address when a seat opens up.
curl -X POST https://watchtower.systems/api/v1/waitlist \
-H "Content-Type: application/json" \
-d '{"email": "[email protected]", "source": "my-agent"}'A successful call returns 200 with {"ok": true, "message": "..."}. Submitting the same address again is harmless.
Free access and sandbox
The API is free and needs no account or API key, so there's nothing to sign up for before your first call. To test an integration without adding anyone to the waitlist, add ?dry_run=true: the request goes through every check (validation and rate limits included) and returns "dry_run": true, but nothing is recorded.
curl -X POST "https://watchtower.systems/api/v1/waitlist?dry_run=true" \
-H "Content-Type: application/json" \
-d '{"email": "[email protected]"}'Endpoint
POST https://watchtower.systems/api/v1/waitlist takes a JSON body with email (required, at most 254 characters) and source (optional, 1 to 64 letters, digits, dots, dashes or underscores; defaults to api).
Errors
Errors are RFC 9457 problem details (application/problem+json) with a stable code to branch on and a hint explaining how to fix the request.
| Status | Code | Meaning |
|---|---|---|
| 400 | invalid_json | The body isn't valid JSON. |
| 404 | not_found | No endpoint at that path. |
| 405 | method_not_allowed | Only POST is accepted. |
| 413 | payload_too_large | The body is over 2048 bytes. |
| 415 | unsupported_media_type | Content-Type must be application/json. |
| 422 | invalid_email / invalid_source / invalid_dry_run | A field or parameter failed validation. |
| 429 | rate_limited | Too many requests; wait for Retry-After. |
| 502 | upstream_unavailable | The signup couldn't be recorded; retry later. |
Rate limits
Each IP address gets 5 requests per 60-second window across /api/*. Every API response, errors included, carries the IETF RateLimit headers: RateLimit-Policy and RateLimit, plus RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset. Over the limit you get a 429 with Retry-After in seconds.
Versioning and deprecation policy
The major version is in the URL path, currently /api/v1. Changes within a version are backward compatible: we only add optional fields, new error codes or new endpoints. Anything that would break an existing client ships under a new path such as /api/v2, and the old version keeps working alongside it.
Before a version is removed, every response from it carries a Deprecation header (RFC 9745), a Sunset header (RFC 8594) with the removal date at least 90 days away, and a Link header with rel="successor-version" pointing to its replacement. The change is also noted here and in the OpenAPI spec. No version is deprecated today.
Support
Questions or problems with the API: email [email protected] or see the contact page.