API
Reach it from your own code.
A key, a bearer header, and the endpoints the dashboard itself runs on. What is missing is written down further down this page, in the same detail.
One key, shown once.
The API is on Growth, Pro and Scale. Create a key in Settings → API keys, give it a name you will recognise in six months, and copy it — there is no route that reads a key back.
Keys begin utmk_, so a leaked one is recognisable as ours by a scanner or a person. Each records when it was last used, which is how you tell a live integration from one you have forgotten about. Revoke or expire any of them without touching the others. Make a key read-only when it only needs to fetch data: it gets a 403 the moment it tries to change anything. Calls are limited per minute for the account — 300 on Growth, 600 on Pro, 1,200 on Scale — and every answer says how many are left, so a script can pace itself instead of guessing.
Request
curl https://app.utmcap.com/api/v1/stats/overview \ -H "Authorization: Bearer utmk_…"
Reply · 200 · sample figures
{ "data": { "range": { "from": "2026-09-20 00:00:00", … }, "clicks": 12480, "bot_clicks": 604, "conversions": 58, "cost": 184.2, "revenue": 306, "profit": 121.8, "roi": 66.12, "cpa": 3.1759, "changes": { "clicks": 8.4, "revenue": 9.7, … } }, "error": null}
Every endpoint below answers on app.utmcap.com/api and is scoped to the account the key belongs to.
What you can call
The endpoints the dashboard uses.
Not a reduced, second-class surface built for outsiders — the same routes the product runs on, which is why they are maintained.
Campaigns and routing
Read and write campaigns, their flow, and the rules that decide where a click goes.
/v1/campaigns/v1/campaigns/{id}/flow/v1/rules/v1/tools/routing
Reporting
The same figures the dashboard draws: an overview, a time series, breakdowns by any dimension, and the export queue.
/v1/stats/overview/v1/stats/timeseries/v1/stats/breakdown/v1/reports/performance/v1/reports/exports
Offers, landers and sources
The objects a campaign is assembled from, including affiliate networks and their integration settings.
/v1/offers/v1/networks/v1/traffic-sources/v1/short-links
Domains
Add a tracking domain, check where it points, and ask for its certificate.
/v1/domains/v1/domains/{id}/verify/v1/domains/{id}/certificate
Account
Your plan and usage, the team, alerts, and the bot-detection settings.
/v1/plan/v1/team/v1/alerts/v1/bot-detection/v1/settings
Corrections
Repair a conversion that never arrived, or a cost that came through wrong.
/v1/corrections/conversions/v1/corrections/cost
Webhooks
A signed call to your own URL on a conversion, a broken or unsafe link, a paused campaign or a plan limit — retried for a day, with a delivery log.
/v1/webhooks/v1/webhooks/test/v1/webhooks/deliveries
Without a key
Three things that need no credential at all.
These are the integration points most people actually use, and none of them involves an API key.
Conversion postback
A server-to-server call from your network or your own checkout, carrying the click id, the payout and a status. The reply says plainly what happened — including click_not_found and bad_secret, rather than a silent 200.
The measurement tag
One script on your landing page. It ties the page view, and anything you mark as a goal, back to the click that paid for it.
The protection script
For pages that make their own decisions — a PHP lander that needs the click id server-side before it renders anything.
All three are written up in the documentation, with the parameters and what each reply means.
Not there yet
What to know before you build against it.
An API page that lists only the endpoints leaves you to discover the rest at the worst moment. These are the ones that would change how you plan an integration. The full reference, the OpenAPI file, webhooks and what we promise about changes are in the documentation.
Keys limited to one area
A key is read-only or read and write, across the whole account. There is no key limited to one campaign or to reports alone, so treat a key as you would a password and give it its own name so you can revoke exactly one integration.
Zapier and Make apps
There is no UTMCAP app in either. Both can still take our webhooks through their catch-a-webhook trigger — a conversion or a broken link arrives as JSON they can act on — and both can call the API.
Building something against it? Tell us what you need — what people are actually calling decides what gets documented and frozen first. The platforms we already speak to are on the supported platforms page.
Point a domain at us and run a click through it.
The free plan takes a hundred thousand clicks a month and no card. If it does not do what you need, you have lost twenty minutes.