API reference
Most of what you need to get tolled is one endpoint you host (the credits API) and a dashboard. But the control plane also exposes a small HTTP API you can call directly: to price a resource, settle a payment from your own runtime, or pull your earnings and audit data into your own tools.
Every endpoint authenticates with an nln_live_ key sent as a bearer token, and
every endpoint is scoped to the site the key is bound to. See
Authentication to mint one.
Interactive reference
The full, always-current reference lives here, covering every endpoint, its parameters, request and response shapes, and a "try it" console:
- API explorer: the interactive reference, right in these docs.
- OpenAPI document:
/docs/api/spec(or straight from the gate athttps://gate.naulon.app/_naulon/openapi.json).
The document is generated from the running code, so it never drifts from what the API actually does. Point any OpenAPI tool (a client generator, Postman, your IDE) at the JSON URL.
What's in it
| Group | Endpoint | Does |
|---|---|---|
| Enforce | GET /_naulon/quote |
Price a resource. 204 means it's free. |
| Enforce | POST /_naulon/verify |
Settle a buyer's payment from your own runtime. |
| Enforce | POST /_naulon/observe |
Report what your runtime decided, so it reaches your Audit page. |
| Config | GET /_naulon/tenants/self |
Your site's current toll config. |
| Earnings | GET /_naulon/earnings |
Earnings rollup for a window. |
| Earnings | GET /_naulon/earnings/statements |
Per-author payout statements. |
| Earnings | GET /_naulon/earnings/reconciliation |
Recorded vs settled vs outstanding. |
| Earnings | GET /_naulon/earnings/export.csv · export.pdf |
Downloadable exports. |
| Audit | GET /_naulon/audit |
The action-audit trail for your org. |
| Members | GET /_naulon/members |
Your author/payee roster. |
| Licences | POST /_naulon/licenses/quote · /licenses |
Price and buy a licence over a scope and period. |
| Webhooks | anomaly.detected · settlement.completed |
What naulon POSTs to you, declared in the document rather than only here. |
The document names its server, so the explorer's "try it" console sends real requests
against the fleet with the key you paste into it. It also declares both webhook events,
including the envelope every signed delivery carries and the three Naulon-* headers that
come with it. Generate a client from the document and you get the handler types too. See
Webhooks for verifying a signature.
The quote, verify and observe endpoints are what the in-app enforcement middleware
calls under the hood, so you only call them yourself if you're building your own
integration. See In-app enforcement for the middleware that
wraps them, and for what each of the three sends.
The explorer also lists the /_naulon/verify-host routes. Those are how a runtime proves
it owns the domain it is enforcing on, which is the WordPress plugin's setup step. There is
nothing to call by hand there; the plugin does it with the key you paste into it.
Read Errors for the response shapes on failure, and Rate limits for what governs request and payload size.