Your agent can ship a working engagement loop this week
Streakline
Reference · OpenAPI 3.1.0

Build the loop.
Own the model.

A focused map of every Streakline endpoint. Scan the surface here, download the source, or launch the full interactive explorer when you need schemas and examples.

Download OpenAPI JSON
Operations
12
Domains
5
Spec
1.0.0

Everything your product can score.

Server/BFF calls use a project- and environment-bound OAuth M2M token. Mobile calls use a short-lived, user-bound client credential minted by your trusted backend.

Authentication

Keep machine authority on your server.

Each OAuth M2M client is bound to one project and environment. Request only the scopes that integration needs; a token cannot act outside that binding.

  1. 1. Ingest trusted server events

    Use a dedicated ingestion OAuth client, bound to the target project and environment, with only events:write. Keep its ID and secret on your server; use the response’s access_token as $INGESTION_OAUTH_ACCESS_TOKEN only for direct server ingestion.

    curl -X POST https://api.streakline.dev/api/auth/oauth2/token \
  -u "$INGESTION_CLIENT_ID:$INGESTION_CLIENT_SECRET" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data "grant_type=client_credentials" \
  --data "resource=https://api.streakline.dev" \
  --data "scope=events:write"

  2. 2. Mint a mobile credential in your BFF

    Use a separate, bound BFF issuer OAuth client with only client_credentials:issue. Keep its credentials on the BFF, set $BFF_OAUTH_ACCESS_TOKEN to this response’s access_token, then use that token only to mint mobile credentials. Derive user_id from your authenticated session and entitlement checks—never trust a value supplied by the mobile app.

    curl -X POST https://api.streakline.dev/api/auth/oauth2/token \
  -u "$BFF_CLIENT_ID:$BFF_CLIENT_SECRET" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data "grant_type=client_credentials" \
  --data "resource=https://api.streakline.dev" \
  --data "scope=client_credentials:issue"
    curl -X POST https://api.streakline.dev/api/v1/client-credentials \
  -H "Authorization: Bearer $BFF_OAUTH_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"user_id":"server-derived-user-id"}'

  3. 3. Call mobile routes with that credential

    Return the structured response to the signed-in client and use its access token for mobile model, event, and current-profile routes. Never embed an OAuth M2M client secret in a mobile or other public client.

    curl https://api.streakline.dev/api/v1/sdk/model \
  -H "Authorization: Bearer $CLIENT_CREDENTIAL"

Client credentials

Short-lived mobile authorization

POST/api/v1/client-credentials

Create a client credential

SDK

Model data consumed by client SDKs

GET/api/v1/sdk/model

Get the SDK scoring model

Events

Track what users do

POST/api/v1/events/batch

Batch mobile events

POST/api/v1/events/batch/server

Batch trusted server events

POST/api/v1/events

Track a trusted server event

Users

Read gamification state

GET/api/v1/me/profile

Get the current mobile user's profile

GET/api/v1/users/{userId}/profile

Get a user's profile server-side

PUT/api/v1/users/{userId}/profile

Import an existing user profile

DELETE/api/v1/users/{userId}

Erase a user

GET/api/v1/users/{userId}/events

List authoritative scored events

GET/api/v1/users/{userId}/achievements

List unlocked achievements server-side

Store

Purchase released economy items

POST/api/v1/store/purchases

Purchase a released store item