Docs › API reference › Account

Account API: keys, plan, export and deletion

Find out who a key acts for, manage API keys and your plan, and export or delete your data.

Updated

This page covers your account and organization. Most of the actions here need a signed-in person, not an API key. Each section says which. The full list is in Authentication.

GET /v1/me

Who am I

GET /v1/me returns the person and the organization the call acts for.

With an API key, user and role are null: a key belongs to the organization, not to a person. name can be null. organization is the current workspace and role is your role in it (owner or member). See Workspaces and members.

curl https://omniposts.dev/v1/me \
  -H "Authorization: Bearer omniposts_..."

{
  "user": { "id": "0192a3b4-0000-7000-8000-000000000a01", "email": "ada@example.com", "name": "Ada" },
  "organization": { "id": "0192a3b4-0000-7000-8000-000000000b01", "name": "Ada Co" },
  "role": "owner"
}

API keys

  • GET /v1/api-keys lists the organization's keys.
  • POST /v1/api-keys creates one. The secret key is in the response once.
  • DELETE /v1/api-keys/{id} revokes one.

Creating and revoking need a signed-in person. All three, with examples, are in Authentication.

GET /v1/plan

Your plan

GET /v1/plan shows your plan, what you have used, and every plan's limits. For the numbers and the plan descriptions see Plans and pricing.

(plan is abridged here, and plans is empty. Read the live response for the full objects and the real limits.)

Field Meaning
billing early_access while there is no billing
plan Your plan: id (free, creator or pro), name, summary, channels (connected channels at once) and postsPerMonth (posts created in a UTC calendar month, or null for no limit)
usage channels connected now and postsThisMonth created so far
plans Every plan in the same shape

usage.postsThisMonth counts a post, not a channel: one post to several channels is one. A cancelled post does not count.

When a limit is reached, connecting a channel or creating a post is refused with 422 plan_limit_reached. details.limit is channels or posts_per_month, and details.plan is your plan id. Lowering a plan never disconnects a channel or cancels a scheduled post. It only refuses new ones above the limit.

PUT /v1/plan with { "plan": "free" } changes the plan. It needs a signed-in person who is an owner of the organization. A key or a non-owner gets 403 forbidden, and a plan id that does not exist is 400 invalid_request.

{
  "billing": "early_access",
  "plan": { "id": "free", "name": "Free" },
  "usage": { "channels": 2, "postsThisMonth": 7 },
  "plans": []
}

GET /v1/settings/consents

Consents

GET /v1/settings/consents lists the notices you accepted, newest first. It needs a signed-in person.

{
  "items": [
    { "purpose": "terms", "noticeVersion": "...", "grantedAt": "2026-10-01T08:00:00Z", "withdrawnAt": null }
  ]
}

GET /v1/settings/export

Export your data

GET /v1/settings/export downloads everything in your organization as one JSON file. It needs a signed-in person.

The response is an attachment named omniposts-export-<yyyy-mm-dd>.json, with Cache-Control: no-store. You can download three exports an hour (429 with Retry-After after that).

The file holds exportedAt, format, and the sections organization, users, channels, consents, ideas, groups, postingSlots, media, metrics, webhooks and auditEvents. The format value is neslivis-export/1: the id predates the OmniPosts name and stays the same so existing importers keep working. Sections are database rows, so their field names are the database's.

The export does not contain secrets (channel tokens, webhook secrets), the bytes of your media files, or raw platform responses. See Export or delete your data.

curl https://omniposts.dev/v1/settings/export \
  -H "Cookie: nsid=..." \
  -o omniposts-export.json

POST /v1/settings/delete-account

Delete your account

POST /v1/settings/delete-account deletes you: your sign-in and your personal data. It needs a signed-in person, and any member may do it. Workspaces you share with others carry on without you; workspaces where you are the only member are deleted with all their data. Channels you connected in a shared workspace are disconnected when you leave it. See Workspaces and members. You must confirm in the body:

Anything else gives 422 confirmation_required. While you are the only owner of a workspace that has other members, the answer is 409 sole_owner_with_members and nothing changes: make one of them an owner, or remove them, first. On success the answer is 202:

Keep confirmationCode as your reference for the request.

{ "confirm": "DELETE" }

{ "confirmationCode": "..." }

Sign up and log in

API clients normally use a key and never need these. They are how the web app starts a session.

All three need the header X-OmniPosts-Client: web and are limited to 20 a minute per IP address (see Rate limits).

Sign up

POST /v1/auth/signup creates a person, an organization and a session.

email and password are required (400 invalid_request if missing). acceptTerms must be true (422 terms_required). name is optional. organizationName defaults to the email address. The password must have at least 10 characters (422 weak_password) and at most 72 bytes (422 password_too_long). An email that already has an account is 409 email_taken.

The answer is 201 with the same body as GET /v1/me, and sets the nsid cookie.

{
  "email": "ada@example.com",
  "password": "correct horse battery",
  "name": "Ada",
  "organizationName": "Ada Co",
  "acceptTerms": true
}

Log in

POST /v1/auth/login takes email and password and answers 200 with the same body as GET /v1/me, and sets the cookie. A wrong pair is 401 invalid_credentials. Log-ins are also limited to 20 a minute per email address.

Log out

POST /v1/auth/logout ends the session and clears the cookie. The answer is 204.