Server API · v1

Server API overview and authorization

The Server API is at https://api.wecloud.biz. Every API Secret belongs to one Project; Test and Production Projects are isolated. An Organisation administrator creates multiple named Secrets in the Dashboard API Keys destination. Plaintext is displayed once. Store it in a backend secret manager and rotate or revoke it from the Dashboard.

curl 'https://api.wecloud.biz/api/videos?limit=20' \
  -H 'Authorization: Apisecret YOUR_PROJECT_SECRET'

The Server API does not allow cross-origin browser use of API Secrets. Your backend calls it, then returns only Viewer-safe data to the browser. A revoked or wrong-Project Secret is rejected. Public errors use a stable code, safe message, requestId, retryable, and optional validated details; use the request ID when contacting support. HTTP statuses retain their usual meanings.

Requests and limits

Native WeCloud mutations require Idempotency-Key; compatible rename and OTP mutations accept it optionally. Identical keyed requests replay for 24 hours within the same Project, Secret, method, and route; changing the body conflicts. Reads and individual multipart part uploads do not require a key.

Published entitlements are 600 management reads per minute per Secret, 120 management writes per minute per Secret, and 3,000 OTP generations per minute per Project with a 300-token burst. Inspect RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, and Retry-After on a 429 response. Breaking versions receive a new major version with at least 12 months of overlap.