API reference.

Base URL: https://app.loopskill.io/api

Auth: x-api-key: $LOOPSKILL_API_KEY header. Write endpoints (create/delete bundles, keys) and locked/tier-gated skill installs require a valid API key. Read-only endpoints (search, skill detail) and free-tier skill installs are public — no key needed.

Rate limit: 60 req/min per key (burst 10). Exceeding returns 429 with a Retry-After header.

There is no public machine-readable spec endpoint today. This page is the reference.

Skills

GET /api/skills/search

Public. Full-text search across the skill catalog.

curl "https://app.loopskill.io/api/skills/search?q=seo+audit&page_size=10"

Query params:

• q — full-text on title + description (optional)
• page_size — 1–100, default 20
• page — 1+ (default 1)
• category — marketing | code | web-scraping | ops | sales | sim-robotics
• tier — free | pro | pro_plus
• sort — updated_at | created_at | title | quality_score (default: quality_score)
• is_public — true | false

Response 200:

{
  "total": 63,
  "results": [
    {
      "slug": "seo-audit-engine",
      "title": "SEO Audit Engine",
      "tier": "pro",
      "quality_score": 0.92,
      "install_count_total": 847,
      "last_verified": "2026-05-01",
      "category": "marketing"
    }
  ]
}

GET /api/skills/{slug}

Public. Skill detail — full description, screenshots, version, install count.

curl "https://app.loopskill.io/api/skills/super-memory"

Response: SkillDetailOut — same fields as summary plus version, screenshots, changelog, external_resources.

Errors: 404 if slug not found.

GET /api/skills/install

Auth required for locked/tier-gated skills. Free-tier skills install anonymously — no key needed. (The MCP transport is stricter: it requires a key for every call, including free-tier lookups — see the install guide.)

curl -H "x-api-key: $RECIPES_API_KEY" \
  "https://app.loopskill.io/api/skills/install?slug=super-memory&mode=files"

Query params:

• slug — skill slug (required)
• mode — always pass files
• version — pin to a specific version (optional; defaults to latest)

Response 200:

{
  "slug": "super-memory",
  "version": "1.4.2",
  "tarball_url": "https://cdn.loopskill.io/skills/super-memory-1.4.2.tar.gz?token=...",
  "manifest": {
    "files": [
      {"path": "SKILL.md", "sha256": "abc123..."},
      {"path": "scripts/setup.sh", "sha256": "def456..."}
    ],
    "signature": "ed25519:base64...",
    "signed_at": "2026-05-01T00:00:00Z"
  }
}

Errors: 401 (no/invalid key), 403 (tier required), 404 (slug not found).

GET /api/skills/access

Auth required. Pre-flight check before install — confirms tier without consuming an install slot.

curl -H "x-api-key: $RECIPES_API_KEY" \
  "https://app.loopskill.io/api/skills/access?skill=super-memory"

Response — access granted:

{"access": true, "tier": "pro", "slug": "seo-audit-engine"}

Response — access denied:

{"access": false, "reason": "tier_required",
 "required_tier": "pro", "upgrade_url": "/pricing"}

GET /api/skills/trending

Public. Returns trending skills by install velocity.

curl "https://app.loopskill.io/api/skills/trending?period=week&page_size=10"

Query params: period (week | month), page_size (1–100, default 20; the legacy limit param is silently ignored — use page_size).

Bundles

All bundle endpoints require auth (x-api-key header).

POST /api/bundles

Create a new bundle.

curl -X POST -H "x-api-key: *** \
  -H "Content-Type: application/json" \
  -d '{"name": "My Team Bundle"}' \
  https://app.loopskill.io/api/bundles

Response: 201 with bundle object including id.

GET /api/bundles

List all bundles for the authenticated account.

GET /api/bundles/{bundle_id}

Get a single bundle with its skill list and version pins.

POST /api/bundles/{bundle_id}/skills

Add a skill to a bundle (pins to current latest version).

curl -X POST -H "x-api-key: *** \
  -H "Content-Type: application/json" \
  -d '{"slug": "seo-audit-engine"}' \
  "https://app.loopskill.io/api/bundles/UUID/skills"

DELETE /api/bundles/{bundle_id}/skills/{slug}

Remove a skill from a bundle.

GET /api/bundles/{bundle_id}/sync

Get the latest-version diff for all skills in the bundle.

GET /api/bundles/{bundle_id}/manifest

Get the full skill manifest (slugs + pinned versions + checksums).

/api/cookbooks/* still works as a backward-compatible alias for every endpoint above — new integrations should use /api/bundles.

API Keys

POST /api/api-keys

Create a new rec_ API key.

curl -X POST -H "Authorization: Bearer $JWT" \
  -H "Content-Type: application/json" \
  -d '{"name": "CI server"}' \
  https://app.loopskill.io/api/api-keys

Response: 201 — key shown once, store securely.

{"key": "rec_...", "id": "uuid", "name": "CI server"}

GET /api/api-keys

List all API keys (hashed — raw keys not re-shown).

DELETE /api/api-keys/{key_id}

Revoke an API key immediately. Inflight requests 401 within 60s.

Telemetry

POST /api/telemetry

Auth required. Anonymous-aggregate event reporting. Called automatically by the meta-skill.

{
  "event": "skill_use",
  "slug": "super-memory",
  "result": "success",
  "duration_s": 47,
  "agent_class_hash": "sha256:..."
}

Skill publishing

POST /api/publish/request

Auth required. Submit a skill for review (CLI path — use the MCP tool loopskill_publish_request for the agent-first path). Rate limited to 1 per 24h per (user, slug). See Publishing docs.

Error codes

Code	Meaning
200	Success
201	Created (POST endpoints)
400	Missing or invalid parameters
401	Invalid or missing API key
403	Subscription required (skill is premium)
404	Skill / bundle / resource not found
429	Rate limited — check Retry-After header
503	Temporary service issue — retry with backoff

OpenAPI spec

Not published today. This page used to point at /openapi.json; that URL returns 404 and always did. The API is FastAPI-based, so a spec exists inside the running service, but nothing serves it to an unauthenticated caller — so there is currently no URL we can honestly give you for Postman, Insomnia, or SDK generation. Until there is, the endpoint tables above are the reference.