Which version this covers
This reference covers next, the current development version, which hasn’t been released. It’s generated from the OpenAPI document at one recorded point in the source code. It lists 731 HTTP operations across 620 paths, grouped into 92 domains, and 772 schemas. Endpoints can change before a release.
Authentication guide
Most endpoints accept one of two credentials:
- an access token, which is a JWT, sent as
Authorization: Bearer <token> - an API key, sent as
X-API-Key: <key>
Your role, your project memberships and the key’s scopes then decide what you can do. A key’s scopes limit which kinds of request it may make. Webhooks, SCIM, shared reports, health checks and the streaming routes use their own credentials.
To write test results, you need the QA engineer role or higher, with either credential. Sending live results through the streaming routes needs an API key tied to one project. The MCP server accepts access tokens only. API authentication explains how to get each credential.
To make your first request:
-
Create a personal API key in Settings › Account › My API keys.
-
Set
TL_URLto your backend’s address. In the default local setup, that’shttp://localhost:8000. -
Set
TL_API_KEYto your key. -
Run this command:
Terminal window curl --fail-with-body "$TL_URL/api/v1/projects" -H "X-API-Key: $TL_API_KEY"
Would you rather use the command-line tool, a client library or the MCP server? See SDK, CLI, and MCP.
Operations by domain
The operation index lists every endpoint, grouped by domain, with a search box and filters for method and domain. Each endpoint page shows what the endpoint does, its parameters, its request body, its responses and the credential it needs.
Schemas
The schema index lists the data format, or schema, of every request and response. Each schema page shows its fields and their types, the endpoints that use it, and the schemas that contain it.
Streams
The streams guide explains how to connect and sign in to the live WebSocket and server-sent event streams. These streams aren’t in the OpenAPI document, and they authenticate differently from ordinary endpoints. The guide also explains what each health route reports.
Endpoints with undocumented responses
For 228 endpoints, the OpenAPI document doesn’t yet describe the fields of the JSON they return. Their pages list the status codes and say that the response fields aren’t documented, instead of guessing them. This is a gap in the documentation, and it doesn’t mean those endpoints fail. See the endpoints with undocumented responses.
Endpoints that return a file, a stream or no body at all are labelled that way. By design, 46 endpoints return no body.
OpenAPI download
To generate a client or import the API into another tool, download the OpenAPI document from the operation index. The index also shows the file’s SHA-256 checksum.
Your own installation’s backend serves an interactive Swagger UI at /api-docs. It also serves ReDoc at /api-docs/redoc. In the web app, the /docs address opens the user guide instead.
A running installation matches this reference only if it runs the same version of the code.
More in the TestLookup repository on GitHub:
- API guide. Its endpoint counts are older than this reference.
- OpenAPI document
- Endpoint index