API Reference

Community Developer API

RESTful JSON API with scoped API keys, rate limiting, and full coverage of chat, members, content, courses, events, and more.

Back to Developers Webhooks Reference

Authentication

Authenticate every request by including your API key in the X-Api-Key header. Create keys from Admin → Developer API in your community dashboard.

# Include your API key in every request
curl -X GET https://api.memberpad.com/dev/v1/members \
  -H "X-Api-Key: sk_live_your_api_key_here" \
  -H "Content-Type: application/json"

Keep your API keys secret. Never expose them in client-side code, public repositories, or browser requests. API keys are for server-to-server communication only.

Base URL

https://api.memberpad.com/dev/v1

All endpoints are relative to this base URL. HTTPS is required. HTTP requests are rejected.

Error Responses

The API uses standard HTTP status codes. Error responses include a JSON body with error and message fields.

Status	Code	Description
400	bad_request	Invalid request body or parameters
401	unauthorized	Missing or invalid API key
403	forbidden	API key lacks the required scope
404	not_found	Resource does not exist or belongs to another community
429	rate_limited	Too many requests. Check `X-RateLimit-Remaining` header
500	server_error	Internal server error

Error Response Example

{
  "error": "forbidden",
  "message": "API key lacks required scope: chat:write"
}

Rate Limits

Limit		Description
100/min		Overall requests per API key per minute
30/min		Write operations (POST, PUT, DELETE) per key per minute
10/sec		Burst limit: max requests per second

Check X-RateLimit-Remaining in response headers to monitor your budget. On 429, use the retryAfter field (seconds) before retrying.

Chat Messages

Post messages to chat rooms from bots and external systems. Messages appear in real-time with a bot indicator badge.

GET/chat/roomschat:read

List all chat rooms in your community.

Response

{
  "rooms": [
    {
      "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
      "name": "General",
      "description": "General discussion",
      "memberCount": 142
    }
  ]
}

POST/chat/rooms/{roomId}/messageschat:write

Post a message to a chat room. Supports plain text, HTML, and structured card format. Messages are delivered in real-time via WebSocket.

Request Body

Field	Type	Description
content	string	required The message text
format	string	optional`"text"`, `"html"`, or `"card"` (default: `"text"`)
card	object	optional Structured card for rich displays (when format is `"card"`)
card.title	string	Card heading
card.fields	array	Array of `{label, value}` pairs
card.color	string	Hex color for the card accent (e.g. `"#22c55e"`)

Request: Plain Text

{
  "content": "Hello from my trading bot!"
}

Request: Rich Card

{
  "content": "BUY Signal - AAPL",
  "format": "card",
  "card": {
    "title": "BUY Signal - AAPL",
    "fields": [
      { "label": "Entry", "value": "$185.20" },
      { "label": "Target", "value": "$192.00 (+3.7%)" },
      { "label": "Stop Loss", "value": "$181.50 (-2.0%)" }
    ],
    "color": "#22c55e"
  }
}

Response: 201 Created

{
  "success": true,
  "message": {
    "id": "f1e2d3c4-b5a6-7890-abcd-ef1234567890",
    "roomId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "content": "BUY Signal - AAPL",
    "createdAt": "2026-03-28T14:30:00Z",
    "isBot": true,
    "botName": "Trading Bot"
  }
}

GET/chat/rooms/{roomId}/messageschat:read

Retrieve recent messages from a chat room.

Query Parameters

Param	Type	Description
limit	integer	optional Number of messages, 1-100 (default 50)
before	string	optional ISO 8601 timestamp for cursor-based pagination (returns messages before this time)

DELETE/chat/rooms/{roomId}/messages/{messageId}chat:write

Delete a message posted by this API key. Only messages created by the same key can be deleted.

Members

Read member data for CRM sync, analytics, or external dashboards. Invite new members programmatically.

GET/membersmembers:read

List community members with pagination and search.

Query Parameters

Param	Type	Description
page	integer	optional Page number (default 1)
pageSize	integer	optional Items per page, 1-100 (default 25)
search	string	optional Search by name or email

Response

{
  "members": [
    {
      "id": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
      "displayName": "Jane Smith",
      "email": "jane@example.com",
      "role": "PaidMember",
      "planName": "Pro Monthly",
      "joinedAt": "2026-01-15T10:00:00Z",
      "avatarUrl": "https://cdn.memberpad.com/avatars/..."
    }
  ],
  "totalCount": 1432,
  "page": 1,
  "pageSize": 25
}

GET/members/{memberId}members:read

Get a single member's profile and subscription details.

POST/members/invitemembers:write

Send an invitation email to join your community.

Request Body

{
  "email": "newmember@example.com",
  "name": "New Member",
  "message": "Welcome! Join our community."
}

Posts

Create and manage community posts from external content systems, AI pipelines, or RSS feeds.

GET/postsposts:read

List published posts with pagination.

Query Parameters

Param	Type	Description
page	integer	optional Page number (default 1)
pageSize	integer	optional Items per page, 1-50 (default 20)

POST/postsposts:write

Create a new community post.

Request Body

Field	Type	Description
title	string	required Post title
htmlBody	string	required HTML content
isPublished	boolean	optional Publish immediately (default false)
accessLevel	string	optional`"all"` or `"paid"` (default `"all"`)

Request Body

{
  "title": "Weekly Market Recap",
  "htmlBody": "<p>This week the S&P 500 rallied...</p>",
  "isPublished": true,
  "accessLevel": "paid"
}

PUT/posts/{postId}posts:write

Update an existing post. Only include the fields you want to change.

Courses

Read course data and track member progress from external learning systems.

GET/coursescourses:read

List all courses with lesson counts and enrollment data.

GET/courses/{courseId}/progress/{memberId}courses:read

Get a member's progress in a specific course, including completed lessons and overall percentage.

Response

{
  "courseId": "...",
  "memberId": "...",
  "totalLessons": 24,
  "completedLessons": 18,
  "progressPercent": 75,
  "completedAt": null
}

POST/courses/{courseId}/lessons/{lessonId}/completecourses:write

Mark a lesson as completed for a member. Triggers certificate generation if the course is now fully complete.

Request Body

{ "memberId": "b2c3d4e5-f6a7-8901-bcde-f12345678901" }

Events

Create and manage community events from external calendar or scheduling systems.

GET/eventsevents:read

List upcoming and past community events.

POST/eventsevents:write

Create a new event.

Request Body

Field	Type	Description
title	string	required Event title
description	string	optional Event description (HTML supported)
startsAt	string	required ISO 8601 date-time
endsAt	string	optional ISO 8601 date-time
location	string	optional Location or meeting URL
accessLevel	string	optional`"all"` or `"paid"`

Request Body

{
  "title": "Live Trading Session",
  "description": "Join us for live market analysis.",
  "startsAt": "2026-04-15T14:00:00Z",
  "endsAt": "2026-04-15T15:30:00Z",
  "location": "https://zoom.us/j/123456789",
  "accessLevel": "paid"
}

PUT/events/{eventId}events:write

Update an existing event. Only include the fields you want to change.

Stock Picks

Post stock picks and trade alerts from automated trading systems.

GET/stock-picks/listsstock-picks:read

List all stock pick lists in your community.

GET/stock-picks/lists/{listId}/picksstock-picks:read

Get paginated stock picks for a specific list.

Query Parameters

Field	Type	Description
page	int	optional Page number (default `1`)
pageSize	int	optional Items per page, 1-100 (default `50`)

Response

{
  "totalCount": 12,
  "page": 1,
  "pageSize": 50,
  "picks": [
    {
      "id": "...",
      "ticker": "AAPL",
      "action": "BUY",
      "entryPrice": 185.20,
      "targetPrice": 192.00,
      "stopLoss": 181.50,
      "notes": "Strong support at 184",
      "createdAt": "2026-03-29T..."
    }
  ]
}

POST/stock-picks/lists/{listId}/picksstock-picks:write

Add a new stock pick to a list.

Request Body

Field	Type	Description
ticker	string	required Stock symbol (e.g. `"AAPL"`)
action	string	required`"BUY"` or `"SELL"`
entryPrice	number	optional Entry price
targetPrice	number	optional Target price
stopLoss	number	optional Stop loss price
notes	string	optional Analysis or reasoning

Request Body

{
  "ticker": "AAPL",
  "action": "BUY",
  "entryPrice": 185.20,
  "targetPrice": 192.00,
  "stopLoss": 181.50,
  "notes": "Strong support at 184, earnings catalyst next week"
}

Payments

Read-only access to subscription and payment data for external dashboards and accounting.

GET/subscriptionspayments:read

List active subscriptions with plan details and revenue.

GET/paymentspayments:read

List payment transactions with amounts, dates, and status.

Digital Products

Read product catalog and purchase data.

GET/productsproducts:read

List digital products with pricing and purchase counts.

GET/products/{productId}/purchasesproducts:read

List purchases for a specific product with buyer details and timestamps.

Chat Actions

Slash commands members run in chat. MemberPad calls you, and posts your reply back as a card.

Chat actions invert the usual direction. Instead of subscribing to events, you expose one HTTPS endpoint and a community owner points a command at it. When a member types /stock AAPL, MemberPad POSTs to you, waits, and renders the JSON you return. Your response body is the whole point, and the call is never retried, because re-running a command like /buy would be wrong.

There is nothing to register through this API: owners configure actions in their community's Developers area, which is also where the signing secret is issued.

Request

// POST to the URL the owner configured
{
  "type": "chat_action.invoke",
  "invocationId": "3f2a...",
  "command": "stock",
  "argsRaw": "AAPL",
  "args": { "symbol": "AAPL" },
  "timestamp": "2026-07-21T14:03:11Z",
  "community": { "id": "...", "name": "Finance Hero" },
  "room": { "id": "...", "name": "general" },
  "user": {
    "id": "...",
    "displayName": "Jane D.",
    "role": "member",
    "isPaid": true
  }
}

The payload deliberately excludes member email addresses and profile images: your endpoint is a third party the member never chose to trust.

Headers

Header	Type	Description
X-MemberPad-Signature	string	sha256=<hex>, see below
X-MemberPad-Timestamp	number	Unix seconds, signed so it cannot be altered
X-MemberPad-Invocation	string	Unique per run. Use it to make your side idempotent
X-MemberPad-Command	string	The command that ran, without the slash

Verifying the signature

HMAC-SHA256 over timestamp + "." + rawBody, compared in constant time. Reject anything older than five minutes; binding the timestamp into the signature is what stops a captured request being replayed.

const ts = req.headers['x-memberpad-timestamp'];
const sig = req.headers['x-memberpad-signature'];

if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return res.sendStatus(400);

const expected = 'sha256=' + crypto
  .createHmac('sha256', SIGNING_SECRET)
  .update(ts + '.' + rawBody)
  .digest('hex');

Response

// 200 application/json
{
  "title": "AAPL, Apple Inc.",
  "color": "#22c55e",
  "text": "optional line above the card",
  "fields": [
    { "label": "Price", "value": "$231.40" }
  ]
}

Return { "error": "..." } to report a handled failure: the member is told it did not work and nothing is posted to the room.

Limits

Limit	Value	Notes
Response size	16 KB	Read bounded, then abandoned
Card title	120 chars	Trimmed, not rejected
Fields	10	40 char labels, 200 char values
Colour	Hex only	#RGB, #RGBA, #RRGGBB or #RRGGBBAA
Redirects	Not followed	Your URL must be public HTTPS
Retries	None	By design: actions are not idempotent

An endpoint that fails repeatedly is paused automatically and its owner is notified.