HTTP API
API reference
Overview
Public routes live under /api/*. They accept JSON bodies unless noted, return JSON, and use standard HTTP status codes. Many routes rate-limit per IP to protect Supabase and email providers.
Base URL
POST https://satellitelabs.xyz/api/<resource>Authentication
Form-style endpoints (newsletter, careers, waitlists) are unauthenticated by design but validated with Zod schemas and optional RPCs on the server. Do not expose service keys in the browser, call these routes from your backend if you need to hide attribution or apply your own auth layer.
Request format
Send JSON with a explicit content type:
POST /api/newsletter/subscribe
Content-Type: application/json
{
"email": "you@company.com",
"first_name": "Jane",
"last_name": "Doe",
"source": "footer"
}Errors
Failed validation returns 400 with an error string. Rate limits respond with 429. Server or upstream failures use 500, treat them as retryable with backoff.
Newsletter
POST /api/newsletter/subscribe requires email, first_name, and last_name (all trimmed, max 100 chars for names). Optional source identifies where the signup came from (for example footer, blog, or blog-post). Successful subscriptions return JSON with a status from the Supabase RPC layer.
Careers
POST /api/careers/apply carries application payloads (role, links, CV metadata) into the hiring pipeline. Keep attachments in object storage and pass URLs, do not post raw binary to the route.