API & SDKsREST API

REST API

Last updated on May 21, 2026

Interact programmatically with your TofuPilot account using the SDKs or direct HTTP requests. For example, create test runs directly, list and filter units, get user data, and much more.

API basics

The API is exposed as an HTTP/1 and HTTP/2 service over SSL. All endpoints live under the URL https://www.tofupilot.app/api/v2 and follow the REST architecture.

Authentication

TofuPilot API keys are required to authenticate and use the TofuPilot API. Include the key in the Authorization header:

Authorization: Bearer <API_KEY>

Create and manage API keys in your account settings.

Filtering and pagination

List endpoints accept query parameters to narrow results. Filter, sort, and paginate by appending parameters to the URL:

https://www.tofupilot.app/api/v2/units?limit=50&serialNumber=SN-001

Refer to each endpoint's reference for the full list of supported filters.

Error codes

Errors are returned with a standard HTTP status code and a JSON body:

{
  "message": "Human-readable description of the error",
  "code": "NOT_FOUND"
}
HTTPCodeMeaning
400BAD_REQUESTThe request body or query parameters are invalid. Input validation errors also include an issues array.
401UNAUTHORIZEDThe API key is missing or invalid.
403FORBIDDENThe API key does not have permission for this resource.
404NOT_FOUNDThe endpoint or resource does not exist.
409CONFLICTThe request collides with current state (for example, a duplicate serial number).
422UNPROCESSABLE_CONTENTThe payload is syntactically valid but semantically rejected.
429TOO_MANY_REQUESTSRate limit exceeded.
500INTERNAL_SERVER_ERRORAn unexpected server error occurred.

Input validation failures return a BAD_REQUEST with the offending fields in issues:

{
  "message": "Input validation failed",
  "code": "BAD_REQUEST",
  "issues": [
    {
      "path": ["serialNumber"],
      "message": "Required"
    }
  ]
}

Refer to each endpoint's reference for the exact set of errors it can return.

Rate limits

The API limits the number of calls you can make over a period of time. Requests beyond the limit return 429 TOO_MANY_REQUESTS. Contact us if you need higher limits for production workloads.

Endpoints

Every endpoint is grouped by resource in the sidebar. The most frequently used ones are listed below.

How is this guide?

On this page