https://app.testorim.com.
The API surface
The API-key surface is small and deliberately so. It covers what a pipeline, a terminal or an integration needs:
Full detail, including every response field, is in the
API reference.
The API is unversioned in the URL. There is no
/v1 prefix. The
1.0.0 in the reference is a documentation version, not a server version.Scoping
An API key is bound to one user and one workspace. Every request pins the workspace to the key’s, so a key issued for workspace A can never read or write workspace B, even if the owning person belongs to both. If that person is later removed from the workspace, the key stops working. Every list and lookup is workspace-scoped. A resource in another workspace returns404, never 403, so the API does not leak the existence of things
you cannot see.
A key held by someone with the viewer role is read-only: any request that is
not GET, HEAD or OPTIONS is rejected with 403 and
code: "read_only_role".
Rate limits
A throttled request returns
429 with { "error": …, "retryAfter": <seconds> }
and a Retry-After header. There are no X-RateLimit-* headers, so do not
write a client that depends on them.
Rate limits are separate from plan quotas. Exhausting the workspace’s monthly
run allowance also returns 429, but with no Retry-After.
Request rules
- JSON bodies are capped at 1 MB.
- Any string containing a NUL byte rejects the whole request with
400. - Schema failures return
400with anissuesarray naming each problem.
Starting a run
POST /api/runs/trigger responds 202 Accepted with a run id. It does not
wait for the run. Poll GET /api/runs/{id} until the status is terminal, or
let the CLI do it for you.
What the API does not do
- No outbound webhooks. Testorim will not call your server when a run finishes. Trigger the run yourself and read the result.
- No streaming over HTTP. Live screenshots go over the app’s WebSocket, which is session-authenticated and not part of the API-key surface.
- No billing, org or integration management. Those are app-only.