Secret-key admin API for GDPR right-to-erasure. POST a list of up to 50 emails to /deletion-requests to queue a deletion and receive a deletion_request_id; GET /deletion-requests/{id} to poll status and retrieve the deletion receipt. Authenticated with an Authorization Bearer secret (sk_...) API key, unlike the public-key collection endpoints.
openapi: 3.0.3
info:
title: Koala API
description: >-
Koala's developer-facing HTTP surface for its B2B buyer-intent and
go-to-market platform. It has two distinct halves with two distinct auth
models:
1. The **Collection / Batch API** on `https://api2.getkoala.com`, which
ingests visitor identifies, custom events, traits, and account-level data.
It is authenticated by the workspace **public (publishable) project key**
embedded directly in the URL path (`/web/projects/{public_api_key}/...`).
There is no bearer token; the key is not secret and the same key powers the
browser pixel. A `GET` on the project root returns the JSON bootstrap
config the client-side SDK uses to initialize.
2. The **Deletion (GDPR) API** on `https://app.getkoala.com/api/v1`, which
is authenticated with a **secret API key** (`sk_...`) via an
`Authorization: Bearer` header and is used to request and poll
right-to-erasure deletions.
Visitor de-anonymization (IP-to-company), person enrichment, and company
firmographic enrichment are performed by Koala internally (powered by
Clearbit Reveal/Enrich and ZoomInfo) and surfaced in the app, exports,
webhooks, and reverse ETL integrations. Koala does not document a public
REST endpoint to query enriched company/visitor/intent records directly;
that data is consumed through the app, warehouse syncs (BigQuery, Snowflake,
Hightouch, Census), and outbound automations.
termsOfService: https://getkoala.com/legal/terms
contact:
name: Koala Support
email: support@getkoala.com
url: https://getkoala.com/docs
version: '1.0'
servers:
- url: https://api2.getkoala.com
description: Collection API (public project key in path)
- url: https://app.getkoala.com
description: Application / admin API (secret bearer key)
tags:
- name: Collection
description: Server-side ingestion of visitor identifies, events, and traits.
- name: Accounts
description: Account-level (company) trait and event ingestion.
- name: SDK
description: Bootstrap configuration used by the client-side pixel.
- name: Deletion
description: GDPR right-to-erasure requests and status.
paths:
/web/projects/{publicApiKey}:
get:
operationId: getProjectBootstrap
tags:
- SDK
summary: Get SDK bootstrap configuration
description: >-
Returns the JSON configuration the browser pixel needs to initialize
for this workspace. Also useful to verify that a public key or a custom
reverse-proxy install resolves correctly (a valid key returns a JSON
response).
parameters:
- $ref: '#/components/parameters/PublicApiKey'
responses:
'200':
description: Bootstrap configuration returned.
content:
application/json:
schema:
type: object
additionalProperties: true
'404':
description: Unknown or disabled project key.
/web/projects/{publicApiKey}/batch:
post:
operationId: collectBatch
tags:
- Collection
summary: Ingest visitor identifies, events, and traits
description: >-
Sends a batch of visitor-level data to Koala. The request body MUST
include a top-level `profile_id` (from the `ko_id` cookie) or `email`
so the payload can be attached to a visitor. Each of `events` and
`identifies` is limited to 30 entries per request, and every event in a
single request must belong to the same person. A `User-Agent` header is
required or the request may be dropped as bot traffic. Authenticated by
the public project key in the path.
parameters:
- $ref: '#/components/parameters/PublicApiKey'
- $ref: '#/components/parameters/UserAgent'
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/BatchRequest'
examples:
identifyOnly:
summary: Minimal identify
value:
profile_id: 3e6a2c18-3b02-40c4-b8d2-1842c193d3ba
email: person@example.com
customEvent:
summary: Custom event
value:
profile_id: 3e6a2c18-3b02-40c4-b8d2-1842c193d3ba
email: netto@getkoala.com
events:
- message_id: 4b1e-idempotency-key
type: track
event: Created Account
properties: {}
sent_at: '2022-11-09T23:57:14.776Z'
traits:
summary: Visitor traits
value:
profile_id: 3e6a2c18-3b02-40c4-b8d2-1842c193d3ba
email: user@example.org
identifies:
- type: identify
sent_at: '2023-11-30T02:51:36.840Z'
traits:
email: user@example.org
billing_plan: pro
vip: true
responses:
'200':
description: Batch accepted for processing.
content:
application/json:
schema:
$ref: '#/components/schemas/CollectionAck'
'400':
description: Missing profile_id/email or malformed payload.
/web/projects/{publicApiKey}/accounts/batch:
post:
operationId: collectAccountBatch
tags:
- Accounts
summary: Ingest account (company) traits and events
description: >-
Sends account-level firmographic traits and/or account events tied to a
company `domain` (recommended) or Koala `account_id`. An optional
`group_id` disambiguates multiple tenants/workspaces that map to the
same domain. Koala auto-creates the account if the domain has not been
seen. Authenticated by the public project key in the path.
parameters:
- $ref: '#/components/parameters/PublicApiKey'
- $ref: '#/components/parameters/UserAgent'
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/AccountBatchRequest'
examples:
accountTraits:
summary: Account traits
value:
domain: getkoala.com
identifies:
- type: identify
traits:
billing_plan: pro
vip: true
headcount: 100
accountEvent:
summary: Account event
value:
domain: getkoala.com
events:
- message_id: any-idempotent-id
type: track
event: Workspace Created
properties:
workspace_id: '1234567890'
workspace_name: Acme, Inc.
sent_at: '2022-11-09T23:57:14.776Z'
responses:
'200':
description: Account batch accepted for processing.
content:
application/json:
schema:
$ref: '#/components/schemas/CollectionAck'
'400':
description: Missing domain/account_id or malformed payload.
/api/v1/deletion-requests:
post:
operationId: createDeletionRequest
tags:
- Deletion
summary: Request GDPR deletion for a set of emails
description: >-
Queues a right-to-erasure deletion for up to 50 email addresses (extra
emails beyond the first 50 are ignored). Returns a
`deletion_request_id` used to poll status. Authenticated with a secret
API key via `Authorization: Bearer sk_...`.
security:
- SecretApiKey: []
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/DeletionRequest'
example:
emails:
- emails1@email.com
- emails2@gmail.com
responses:
'200':
description: Deletion request accepted.
content:
application/json:
schema:
$ref: '#/components/schemas/DeletionRequestCreated'
'401':
description: Missing or invalid secret API key.
/api/v1/deletion-requests/{deletionRequestId}:
get:
operationId: getDeletionRequest
tags:
- Deletion
summary: Check GDPR deletion status
description: >-
Returns the status and, once completed, the deletion receipt for a
previously created deletion request. Authenticated with the same secret
API key.
security:
- SecretApiKey: []
parameters:
- name: deletionRequestId
in: path
required: true
description: The id returned by createDeletionRequest.
schema:
type: string
format: uuid
responses:
'200':
description: Deletion request status and receipt.
content:
application/json:
schema:
$ref: '#/components/schemas/DeletionRequestStatus'
'401':
description: Missing or invalid secret API key.
'404':
description: Unknown deletion request id.
components:
parameters:
PublicApiKey:
name: publicApiKey
in: path
required: true
description: >-
The workspace public (publishable) project key. This is not a secret;
the same key is embedded in the browser pixel URL.
schema:
type: string
example: my-public-api-key
UserAgent:
name: User-Agent
in: header
required: true
description: >-
Required. Identify your integration (e.g. `your-company-name/1.0.0`).
Requests without a User-Agent may be flagged as bots and dropped.
schema:
type: string
example: your-company-name/1.0.0
securitySchemes:
SecretApiKey:
type: http
scheme: bearer
bearerFormat: sk_
description: >-
Secret API key created in Settings -> API Keys, sent as
`Authorization: Bearer sk_...`. Used only by the Deletion (GDPR) API.
schemas:
BatchRequest:
type: object
description: >-
A visitor-scoped batch. At least one of profile_id or email is
required at the top level.
properties:
profile_id:
type: string
format: uuid
description: The Koala anonymous id read from the `ko_id` cookie (UUID v4).
email:
type: string
format: email
description: Known email used to link this visitor to an identified profile.
events:
type: array
maxItems: 30
items:
$ref: '#/components/schemas/TrackEvent'
identifies:
type: array
maxItems: 30
items:
$ref: '#/components/schemas/IdentifyCall'
page_views:
type: array
maxItems: 30
items:
type: object
additionalProperties: true
anyOf:
- required:
- profile_id
- required:
- email
AccountBatchRequest:
type: object
description: >-
An account-scoped batch. At least one of domain or account_id is
required; domain is recommended.
properties:
domain:
type: string
description: Company domain used as the account key (e.g. getkoala.com).
account_id:
type: string
description: Koala account id, if you already have one.
group_id:
type: string
description: >-
Optional grouping key to disambiguate multiple tenants mapping to
the same domain.
events:
type: array
maxItems: 30
items:
$ref: '#/components/schemas/TrackEvent'
identifies:
type: array
maxItems: 30
items:
$ref: '#/components/schemas/IdentifyCall'
anyOf:
- required:
- domain
- required:
- account_id
TrackEvent:
type: object
properties:
message_id:
type: string
description: Idempotency key used to dedupe replayed/retried events.
type:
type: string
enum:
- track
default: track
event:
type: string
description: Event name (e.g. "Created Account").
properties:
type: object
additionalProperties: true
sent_at:
type: string
format: date-time
required:
- event
IdentifyCall:
type: object
properties:
type:
type: string
enum:
- identify
default: identify
sent_at:
type: string
format: date-time
traits:
type: object
description: >-
Arbitrary visitor or account traits (email, billing_plan, vip,
headcount, group_id, etc.).
additionalProperties: true
required:
- traits
CollectionAck:
type: object
description: Acknowledgement that the batch was accepted.
additionalProperties: true
DeletionRequest:
type: object
required:
- emails
properties:
emails:
type: array
maxItems: 50
items:
type: string
format: email
DeletionRequestCreated:
type: object
properties:
deletion_request_id:
type: string
format: uuid
DeletionRequestStatus:
type: object
properties:
id:
type: string
format: uuid
project_id:
type: string
format: uuid
status:
type: string
example: completed
input:
type: array
items:
type: string
deleted_receipt:
type: array
items:
type: object
additionalProperties: true
created_at:
type: string
format: date-time
updated_at:
type: string
format: date-time
messages:
type: array
items:
type: string