SlateCore API

Read-only REST API for your slate, team, awards, calendar, and finances. Built so your public website (or your coproducers' websites) can read live data from SlateCore — no need to duplicate everything into a separate CMS. We also send outbound webhooks so your site can invalidate the moment something changes here.

Generate your API key from Settings → API & Webhooks inside the app. Available on Studio and Label tiers.

Authentication

Every request requires the X-API-Key header with your key. Keys are hashed with SHA-256 at rest — the cleartext is shown once on creation, so store it safely (secrets manager / env var). If you lose it, revoke and create a new one.

curl -H "X-API-Key: sk_live_..." \
  https://slatecore.app/api/v1/ping

Each key carries a set of scopes (projects:read, team:read, etc.). An endpoint that requires a scope your key doesn't have returns 403 insufficient_scope.

Rate limits

Per-minute and per-day limits configurable per key (defaults: 60/min, 10,000/day). When you exceed, the endpoint returns 429 rate_limit_exceeded with a Retry-After header. Responses are edge-cached with s-maxage=30, stale-while-revalidate=60 — lean on the cache to avoid churning a request per page view.

Errors

All errors share the shape { error, message }:

Webhooks

Receive a POST to your URL whenever a piece of data changes in SlateCore — useful for revalidating Next.js, invalidating Webflow caches, or kicking off deploys. Register a webhook from Settings → API & Webhooks in the app: pick the events you care about and we generate an HMAC secret so you can verify the origin. We retry up to 3 times with backoff (1 min, 5 min, 15 min) if your endpoint returns 5xx or times out.

Events

Payload

Every event arrives in the same shape. tenant_id always points at the receiving tenant — for coproductions you receive one event per collaborating tenant. owner_tenant_id identifies the resource owner when an event arrives via fan-out.

{
  "event": "project.updated",
  "id": "uuid-of-resource",
  "tenant_id": "uuid-of-receiver",
  "proyecto_id": "uuid-or-null",
  "owner_tenant_id": "uuid-or-null",
  "reason": "collaboration_changed",
  "timestamp": "2026-05-05T16:30:00Z"
}

Headers we send: X-Slate-Event, X-Slate-Signature, X-Slate-Delivery (unique id — handy for deduping on your side).

Verify the HMAC signature

Each delivery includes X-Slate-Signature: sha256=<hmac>. Compute the HMAC-SHA256 of the raw body (don't re-stringify the JSON — use the bytes you received) with your secret and compare before trusting it.

const crypto = require('crypto')

app.post('/slate-webhook', (req, res) => {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', process.env.SLATE_WEBHOOK_SECRET)
    .update(req.rawBody)         // raw bytes, not JSON.stringify
    .digest('hex')

  if (req.header('x-slate-signature') !== expected) {
    return res.status(401).end()
  }

  // Respond 2xx fast — process async if slow.
  res.status(200).end()
})

Cross-tenant fan-out

When you edit a shared project, every collaborating tenant's webhooks also fire with their own tenant_id and owner_tenant_id pointing at the owner. Each consumer refetches with its own API key and gets its own view (including its part_of_slate, which is per-tenant).

When a collaborator changes something that only affects them (their own part_of_slate on a shared project), project.updated fires with reason: "collaboration_changed" only to that tenant — the owner doesn't get spammed.

Plan access

The API and webhooks are available on Studio and Label. Indie and School plans don't include API access. Compare plans on slatecore.app. Support: hello@slatecore.app.