Skip to content
ReputeCastReputeCast Docs

Public URLs and endpoints

Reference
For:
Server operators, Developers

This page lists the ReputeCast endpoints a browser, a sending provider, a monitoring tool or another service reaches, grouped by the server role that serves them.

Paths are relative to your public URL (http.public_url). A serve process runs the roles in --role (all three by default, see scale with web, ingest and worker roles): web serves the API, MCP, public pages, tracking and the web app; ingest serves /hooks/…; a worker-only process has no HTTP listener. <token> stands for a signed value ReputeCast puts in the link; treat every URL that contains one as a secret.

Health and metrics

Section titled “Health and metrics”

Served by any process with the web or ingest role.

Path What it is for
GET /healthz Liveness: 200 ok while the process runs.
GET /readyz Readiness: 200 ready, or 503 when the database doesn’t answer within 2 seconds.
/metrics Prometheus metrics, without authentication. On the main port when metrics.enabled is on and metrics.addr is empty. When metrics.addr is set, metrics move to that address (any path), for every role including worker-only.

Health checks, metrics and logs lists the metric series.

API and MCP

Section titled “API and MCP”

Served by the web role.

Path What it is for
/api/v1/… The REST API. See the API reference.
/api/openapi.json, /api/openapi.yaml The OpenAPI 3.1 document, without authentication. /api/openapi-3.0.json and /api/openapi-3.0.yaml give OpenAPI 3.0.
any other /api/… 404 problem document with the code not_found.
/mcp The MCP server (Streamable HTTP) for agent tokens rc_agent_…. See MCP tools.

Public pages

Section titled “Public pages”

Served by the web role under /p/<workspace>/…, where <workspace> is the workspace slug. On a verified custom domain the same pages answer at the root (see custom domains). Paths in this table are relative to /p/<workspace>.

Path What it is for
/ The website home when the newsletter website is on; otherwise a redirect to /subscribe.
/subscribe, /subscribe/<form> Hosted signup page, for the default form or one form.
/forms/<id>.js Embed script of a signup form. It calls /forms/<id>/session and /forms/<id>/submit.
/confirm/<token> Double opt-in confirmation link.
/preferences, /preferences/<token> “Email me my link” form; the preference center.
/unsubscribe/<token> Unsubscribe page. A POST with the body List-Unsubscribe=One-Click is the RFC 8058 one-click unsubscribe target.
/view/<token> The email in a browser.
/archive, /archive/<issue>, /archive.rss, /sitemap.xml Public archive, one issue, its RSS feed, and the sitemap.
/sms-terms Text-message terms page.
/poll/<token>/<answer>, /s/<slug> Poll answer page (the vote is recorded by the page’s POST, not by opening the link); survey page.
/join/<code>, /referrals, /referrals/<token>, /leaderboard, /rewards/<token> Referral invite page, referral hub, leaderboard and reward downloads.
/recommends, /recommends/<token> Recommendations page.
/upgrade, /upgrade/<tier>, /billing/<token>, /cancel/<token> Upgrade page and Stripe Checkout, the Stripe billing portal, and the cancel page.
/gift, /gift/redeem/<code> Buy and redeem a gift subscription.
/products, /products/<slug>, /buy/<product>, /d/<token>, /l/<token> Shop, product page, checkout, download page and lead-magnet download.
/<slug> A published landing or sales page (/<slug>/event.ics is its calendar file).
/posts/<slug>, /tag/<slug>, /feed Newsletter website posts, tag pages and the site’s RSS feed.
/signin, /account Website member sign-in and account.
/push/… Endpoints the web push prompt uses to subscribe and unsubscribe a browser.

Two paths sit outside a workspace:

  • /p/_/… serves the pages’ shared CSS, scripts and fonts. GET /p/_/tls-check?domain=<host> answers 200 when the host is a verified custom domain and 404 otherwise, for Caddy’s on-demand TLS ask setting.
  • /p/<code> with a partner code (XXXX-XXXX-XXXX) explains how to paste the code into another ReputeCast instance; opening it doesn’t use the code.

Pages reached through a signed link are noindex. A HEAD request to a token page does nothing, so link scanners can’t confirm, unsubscribe or vote. The instance’s robots.txt disallows everything except /p/.

Custom domains

Section titled “Custom domains”

When a workspace’s custom domain is verified (a CNAME to the instance host, matching A/AAAA records, or the _reputecast.<domain> TXT record), the public pages answer at the root of that domain: https://news.acme.io/subscribe is the same page as /p/acme-newsletter/subscribe. ReputeCast finds the workspace from the Host header, so your proxy must forward it unchanged.

  • Links on pages served from the custom domain leave out /p/<workspace>. Scripts, theme files and shared assets keep their /p/<workspace>/… and /p/_/… paths.
  • The custom domain gets its own robots.txt and sitemap.xml.
  • Emails keep linking to the public URL.
  • On the instance’s own host, root paths such as /subscribe belong to the web app.

Brand your pages and use your own domain covers the DNS step, and reverse proxy and TLS the certificates.

Section titled “Tracking and short links”

Served by the web role.

Path What it is for
/t/o/<token> Open-tracking pixel (a 1×1 GIF).
/t/c/<token> Click tracking: records the click and redirects to the link in the message. The target is inside the signed token, so it can’t be used as an open redirect.
/t/p/<id>.<token> Web push click: redirects to the notification’s link.
/t/s/<code> SMS short link on the instance host. On a verified SMS short-link domain, the six-character code works at the root: /<code>.
Section titled “Report links”
Path What it is for
/r/<token> A read-only campaign report share link, or a sponsor report. Revoked or expired links stop working. Served by the web role.

Webhooks

Section titled “Webhooks”

Served by the ingest role. ReputeCast shows the exact URL, with its token, when you connect the service. An unknown token gets 404 and a bad signature 401 (400 for Stripe).

Path What it is for
POST /hooks/<adapter>/<token> Sending-provider events. <adapter> is ses, postmark, postal, brevo, resend, sparkpost, mailjet, mailgun, sendgrid, azureacs, smtp, httpgeneric or community:<id>.
POST /hooks/sms/<adapter>/<token> SMS delivery receipts and inbound texts (twilio, vonage, plivo, telnyx, aws_eum).
POST /hooks/stripe/<token> Stripe payment events.
POST /hooks/shopify/<token>, POST /hooks/woocommerce/<token> Store events.
GET, POST /hooks/whatsapp/<workspace> Meta’s WhatsApp webhook: GET verifies the subscription, POST delivers events.

Delivery events and suppression sync explains what happens to sending-provider events.

Sign-in callbacks and other paths

Section titled “Sign-in callbacks and other paths”

Served by the web role.

Path What it is for
/auth/oidc/<slug>/callback Redirect URI of an OIDC single sign-on provider.
/auth/social/<kind>/callback Redirect URI for Google, Microsoft and GitHub sign-in (<kind> = google, microsoft, github).
/api/v1/placement/oauth/callback Redirect URI for seed mailboxes connected with OAuth.
/integrations/shopify/app, /integrations/shopify/callback The Shopify app’s App URL and redirect URL.
/media/<id>/<file> Images uploaded to the media library and used in emails and pages.
/push/v1/…, /rc-push-sw.js Web push prompt script and service worker.
/.well-known/acme-challenge/… Let’s Encrypt HTTP-01 challenge for the SMTP relay certificate.
/partner/v1/… Signed protocol between ReputeCast instances for partner recommendations.
everything else The web app: /sign-in, /setup, /invite/<token>, /reset-password/<token>, /w/<workspace>/…. Sent with noindex.
Section titled “Related”
Report a problem with this pageReputeCast websiteHostReputeContent licensed under CC BY 4.0