API overview

Base URL: https://onboard.bootstrapware.co. Responses wrap payloads in { "data": ... }.

Publishable (browser / widget)

Use a publishable key (bsw_test_pub_ / bsw_live_pub_) as Authorization: Bearer. These routes are what the Hosted <Onboard> widget calls.

• GET /api/v1/config/:flowId: published flow config (items, eligibility, origins, toggles)
• Hosted progress: get / complete / skip / unskip / dismiss / snooze / resume / reset (live needs authorToken)
• POST /api/v1/outcomes: integration-reported summaries (Hosted)

Live config fetch requires BYO ($9.99) or Hosted ($19.99). Live Hosted progress writes require Hosted ($19.99) plus authorToken from your BFF. Test keys stay free.

Secret (server management)

Use a secret key (bsw_test_sec_ / bsw_live_sec_) as Bearer. Never put secret keys in the browser. These routes configure flows without the dashboard UI.

• GET /api/v1/flows: list flows in the key's workspace
• POST /api/v1/flows: create; body { "name": "SaaS first-run" }
• GET /api/v1/flows/:id: flow, revisions, draft, and published config
• PATCH /api/v1/flows/:id: save draft name + config
• POST /api/v1/flows/:id: publish; body { "action": "publish" }
• GET /api/v1/usage: aggregate operational session counts
• POST /api/v1/author-tokens: mint a short-lived host assertion

PATCH config requires items and emptyState. Optional fields include requireAuthorToken, snoozePresetsDays, allowedOrigins, eligibility, dismiss copy, and branding. Unknown keys such as snoozeDays are ignored. Unlike MCP update_draft, this PATCH replaces the draft rather than merging omitted items.

Create, draft, publish

# Create
curl -s -X POST https://onboard.bootstrapware.co/api/v1/flows \
  -H "Authorization: Bearer $BSW_SECRET" \
  -H "Content-Type: application/json" \
  -d '{"name":"SaaS first-run"}'

# Save draft (replace FLOW_ID). PATCH requires items + emptyState and replaces the draft
# (MCP update_draft can omit items and merge). Use snoozePresetsDays, not snoozeDays.
curl -s -X PATCH https://onboard.bootstrapware.co/api/v1/flows/FLOW_ID \
  -H "Authorization: Bearer $BSW_SECRET" \
  -H "Content-Type: application/json" \
  -d '{
    "name":"SaaS first-run",
    "config":{
      "requireAuthorToken":true,
      "emptyState":"You are all set.",
      "allowedOrigins":["http://localhost:3000"],
      "snoozePresetsDays":[1,7],
      "items":[
        {"key":"create_workspace","title":"Create your workspace","progressScope":"workspace"},
        {"key":"invite_teammate","title":"Invite a teammate","dependsOn":["create_workspace"],"progressScope":"workspace"},
        {"key":"connect_billing","title":"Connect billing","dependsOn":["create_workspace"],"progressScope":"user","factKey":"hasBilling"},
        {"key":"import_data","title":"Import your data","optional":true,"dependsOn":["create_workspace"],"progressScope":"workspace"}
      ]
    }
  }'

# Publish
curl -s -X POST https://onboard.bootstrapware.co/api/v1/flows/FLOW_ID \
  -H "Authorization: Bearer $BSW_SECRET" \
  -H "Content-Type: application/json" \
  -d '{"action":"publish"}'

# Author token (BFF only)
curl -s -X POST https://onboard.bootstrapware.co/api/v1/author-tokens \
  -H "Authorization: Bearer $BSW_SECRET" \
  -H "Content-Type: application/json" \
  -d '{"authorId":"user_123","flowId":"flw_...","workspaceKey":"ws_acme","expiresInSec":3600}'

# Usage
curl -s https://onboard.bootstrapware.co/api/v1/usage \
  -H "Authorization: Bearer $BSW_SECRET"

Still dashboard-only

Minting or revoking live or secret API keys, webhook endpoints, flow delete, branding, billing, Hosted progress export, and summaries preview stay on the platform dashboard (cookie session). The secret management API and MCP do not cover those. Test publishable keys: call ensure_test_publishable.

Hosted MCP

The same flow-management capabilities are exposed as HTTP MCP at https://onboard.bootstrapware.co/mcp. Prefer OAuth Connect: install the URL-only config from the Keys page, click Connect in Cursor, and approve. No secret is stored in mcp.json. A test secret pasted as a Bearer header still works as a fallback. Tools: list_flows, get_flow, create_flow, update_draft (does not publish; name optional; items may include optional href and ctaLabel), publish_flow, list_revisions, restore_revision, get_published_config, get_install_snippet, ensure_test_publishable, list_capabilities. Never send host context, flags, or progress payloads through MCP. See Agents for setup details.

Related: Configuration · API keys · Identity · AGENTS.md