API

Everything the app does goes through this API, so scripts can do it too. Requests and responses are JSON. The web app serves the API at https://ignitra.run/api: every path below goes after that, e.g. https://ignitra.run/api/v1/flows.

Sign in

Two ways in, both sent as Authorization: Bearer …. Scripts use an API key (igk_…, Team plan): create one under Settings and see SDK & API keys. On any plan, a wallet session works too: you sign a Sign-In with Ethereum (EIP-4361) message. Signing is free, sends no transaction and needs no funds. Smart-contract wallets work too (ERC-1271).

1. GET /v1/auth/nonce gives a single-use nonce, the accepted domains and chain_id 4663.
2. Build the message with one of those domains, a URI on it, chain id 4663 and the nonce, and sign it (personal_sign).
3. POST /v1/auth/verify with { "message", "signature", "return_token": true } returns a session token, igs_….
4. Send it as Authorization: Bearer igs_…. Sessions expire (see expires_at); sign in again then.

// Node 20+, with viem (npm i viem). Sign in with the wallet that owns your flows:
// the key stays on your machine, IGNITRA only ever receives the signature.
import { privateKeyToAccount } from "viem/accounts";
import { createSiweMessage } from "viem/siwe";

const API = "https://ignitra.run/api";
const account = privateKeyToAccount(process.env.WALLET_PRIVATE_KEY); // or any viem wallet (hardware, WalletConnect…)

const { nonce, domains, chain_id } = await (await fetch(`${API}/v1/auth/nonce`)).json();
const message = createSiweMessage({
  address: account.address,
  chainId: chain_id, // 4663, Robinhood Chain
  domain: domains[0],
  uri: "https://ignitra.run",
  nonce,
  version: "1",
  issuedAt: new Date(),
  statement: "Sign in to IGNITRA",
});
const signature = await account.signMessage({ message });

const res = await fetch(`${API}/v1/auth/verify`, {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({ message, signature, return_token: true }),
});
const { token, expires_at } = await res.json();

// Every other call: Authorization: Bearer <token>
const flows = await (await fetch(`${API}/v1/flows`, { headers: { authorization: `Bearer ${token}` } })).json();
console.log(expires_at, flows.data.map((f) => `${f.name}: ${f.status}`));

Browsers get an HttpOnly ignitra_session cookie instead of a token. Cookie-authenticated writes must come from the IGNITRA site itself (CSRF protection). Treat a bearer token like a password: anyone who has it acts as you until it expires or you log out.

Conventions

• Ids are prefixed: fl_ flows, run_ runs, conn_ connections, usr_ users, key_ API keys, grt_ onchain grants, oca_ onchain actions. Times are ISO-8601 UTC; addresses are lowercase.
• Results come wrapped in data (the sign-in endpoints answer flat). Runs page backwards: pass the response's next_before as before until it is null.
• Errors are { "error": { "code", "message", … } } with a meaningful status:

Example: create a flow

curl -X POST "https://ignitra.run/api/v1/flows" \
  -H "Authorization: Bearer $IGNITRA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Big USDG transfers",
    "activate": true,
    "definition": {
      "trigger": { "type": "TOKEN_TRANSFER", "params": { "token": "0x5fc5360d0400a0fd4f2af552add042d716f1d168" } },
      "conditions": { "all": [{ "field": "amount_decimal", "op": ">=", "value": "10000" }] },
      "actions": [{ "step_id": "notify", "type": "WEB_PUSH", "params": { "title": "Big transfer", "body": "{{trigger.amount_formatted}} {{trigger.token.symbol}}" } }]
    }
  }'

Easier: start from a template with POST /v1/templates/:slug/instantiate, which only needs the placeholder values.

Endpoints