Base URL and authentication
Every request carries an API key, and the key itself determines which community you are acting on — there is no community id in the path. That is deliberate: with no session to check membership against, deriving scope from the key is stronger than trusting a path parameter.
https://app.maxlevel.be/api/v1/externalAvailable on every plan. The free tier is rate-limited to 1,000 calls a day rather than blocked, because a developer who cannot make one call cannot evaluate the integration.
Endpoints
| Method | Endpoint | What it does |
|---|---|---|
| GET | /whoami | Confirms a key works and shows the community and tier it is bound to. The fastest way to check an integration is wired up. |
| GET | /actions | The action definitions this key may log against — id, name, description, XP value, and frequency limit — so an integrator can discover ids without opening the UI. |
| POST | /actions/register | Log a completed action for a member. Accepts an Idempotency-Key header, so a retry after a timeout cannot double-award. |
Outbound webhooks
The signing scheme is real and worth knowing about if you are planning an integration: deliveries are signed with an HMAC over the timestamp and the body, so a captured request cannot be replayed, and the delivery path re-checks the destination against private address ranges at send time rather than only at registration.
What does not exist yet is subscription: there is no way to register an endpoint, so none of the events below can currently reach you. They are listed so you can plan, not so you can build against them today.
action.loggedlevel.upbadge.unlockedstreak.brokenseason.endedreward.requested