Turelis API

Authentication

Create an API key in Settings → Developers (shown once, stored hashed; revoke anytime). Send it on every request:

Authorization: Bearer <your-api-key>

Keys are scoped to your workspace. Free accounts include API access with standard rate limits; higher limits come with paid plans.

Endpoints

Method & path	What it does
GET /integrations	Your connected, publishable channels (id, platform, name).
GET /integrations/{platform}/schema	Platform rules: length limits, media support, thread shape.
POST /upload	Upload an image; returns a media id to attach to posts.
GET /posts	List posts (filter by status).
POST /posts	Create a post: body, target integration ids, optional schedule time, optional media. Idempotency supported via Idempotency-Key.
GET /posts/{id}	One post with per-target publish status.
DELETE /posts/{id}	Delete a post (targets not yet published are cancelled).
GET /analytics/{platform}	Published-post metrics where the platform reports them.
POST /generate/image	Render a simple branded text card for a post (no AI spend).

Create and schedule a post

curl -X POST https://turelis.com/public/v1/posts \
  -H "Authorization: Bearer $TURELIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "body": "Shipping notes, day 41: the boring migration nobody tweets about.",
    "integrations": [123],
    "scheduled_for": "2026-08-15T09:00:00Z"
  }'

Omit scheduled_for to create a draft; your review queue and calendar see API posts exactly like app posts.

Webhooks

Register a webhook URL in Settings → Developers and receive events for post.published and post.failed. Deliveries are:

• Signed — every request carries X-Turelis-Signature, an HMAC-SHA256 of the raw body with your webhook secret. Verify before trusting:

import hashlib, hmac

def verify(secret: str, raw_body: bytes, signature: str) -> bool:
    expected = hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)

• Retried with backoff on non-2xx responses.
• Private-network safe — targets on internal addresses are refused at registration.

MCP server

The hosted MCP endpoint lets AI agents (Claude, Cursor, anything MCP-capable) list your channels and create posts using the same API key:

{
  "mcpServers": {
    "turelis": {
      "url": "https://turelis.com/mcp",
      "headers": { "Authorization": "Bearer <your-api-key>" }
    }
  }
}

The server exposes post-creation, channel listing, and image tools. Your approval settings still apply — an agent can draft and schedule, and anything your autopilot mode routes to review still waits for you.

Rate limits & errors

Standard accounts: 100 requests/hour per key. Responses use conventional status codes; errors return {"error": "human-readable message"}. 429 includes a Retry-After header.

Something missing? Tell us — the CLI and n8n/Make integrations are used internally and roll out as public packages; ask and we'll set you up early.