API overview

Base URL: https://importer.bootstrapware.co. Responses wrap payloads in { "data": ... }. Rate limits apply per key (publishable and secret tiers differ).

Publishable (browser / widget)

Use a publishable key (bsw_test_pub_ / bsw_live_pub_) as Authorization: Bearer. These routes are what the hosted <Importer> component calls.

• GET /api/v1/config/:importerId
• POST /api/v1/sessions
• POST /api/v1/sessions/:id/complete

Live publishable config requires a paid entitlement. Test keys and local fields schema stay free.

Secret (server management)

Use a secret key (bsw_test_sec_ / bsw_live_sec_) as Bearer. Never put secret keys in the browser. These routes configure hosted importers without the dashboard UI.

• GET /api/v1/importers: list importers in the key's workspace
• POST /api/v1/importers: create; body { "name": "Customers" } → { importerId, revisionId }
• GET /api/v1/importers/:id: importer, revisions, draft, and published config
• PATCH /api/v1/importers/:id: save draft name + config → { revisionId }
• POST /api/v1/importers/:id: publish; body { "action": "publish" }
• GET /api/v1/usage: aggregate of recent session metadata for the workspace

PATCH config.fields items use key, label, type (string | number | date | email | enum | boolean | url), and optional required, unique, enumValues, aliases. Optional duplicateKey on config. This PATCH schema does not accept branding; set branding in the dashboard if needed.

Create, draft, publish

# Create
curl -s -X POST https://importer.bootstrapware.co/api/v1/importers \
  -H "Authorization: Bearer $BSW_SECRET" \
  -H "Content-Type: application/json" \
  -d '{"name":"Customers"}'

# Save draft (replace IMPORTER_ID)
curl -s -X PATCH https://importer.bootstrapware.co/api/v1/importers/IMPORTER_ID \
  -H "Authorization: Bearer $BSW_SECRET" \
  -H "Content-Type: application/json" \
  -d '{
    "name":"Customers",
    "config":{
      "fields":[
        {"key":"email","label":"Email","type":"email","required":true},
        {"key":"name","label":"Name","type":"string","required":true}
      ],
      "duplicateKey":"email"
    }
  }'

# Publish
curl -s -X POST https://importer.bootstrapware.co/api/v1/importers/IMPORTER_ID \
  -H "Authorization: Bearer $BSW_SECRET" \
  -H "Content-Type: application/json" \
  -d '{"action":"publish"}'

# Usage
curl -s https://importer.bootstrapware.co/api/v1/usage \
  -H "Authorization: Bearer $BSW_SECRET"

Still dashboard-only

Minting or revoking API keys, webhook endpoints, importer delete, and draft branding stay on the platform dashboard (cookie session). The secret management API does not cover those yet.

Hosted MCP

The same secret-key capabilities are exposed as HTTP MCP at https://importer.bootstrapware.co/mcp. Prefer OAuth Connect: install the URL-only config from the Keys page, click Connect in Cursor, and approve, no secret is stored in mcp.json. A test secret pasted as a Bearer header still works as a fallback. See Agents for setup details. Publishing does not skip paid entitlement for live publishable config fetch.

Related: Configuration · Sessions · API keys · Agents