Trellis Group API

A small, predictable REST API. JSON in, JSON out, no surprises.

Authentication

Every request carries a bearer token issued in the dashboard. Tokens are scoped per environment and can be rotated without downtime — both the old and the new token work during the overlap window.

curl https://api.nl3.hubfit.org/v2/items \
  -H "Authorization: Bearer <token>" \
  -H "Accept: application/json"

Items

GET /v2/items

Returns a page of items, newest first. Pagination is by cursor: pass the next value from the previous response.

Parameter	Type	Notes
`limit`	integer	1–200, default 50
`cursor`	string	opaque, from `next`
`archived`	boolean	excluded unless set

{
  "data": [{ "id": "itm_8Kd2", "title": "Quarterly report", "created_at": "2026-07-14T09:12:03Z" }],
  "next": "eyJvIjoxMjB9"
}

Events

Every change to an item produces an event. The log keeps 30 days; older events are pruned nightly.

Webhooks

Callbacks are signed with HMAC-SHA256 over the raw body. Verify the signature before parsing — a request that fails verification should be discarded, not retried.

X-Signature: t=1767225600,v1=6f2b...c19a

Failed deliveries are retried with exponential backoff for 24 hours, then dropped.

Errors

Status	Meaning
`400`	the request body did not validate
`401`	missing or revoked token
`409`	the resource changed since you read it
`429`	rate limit — see `Retry-After`

Rate limits

600 requests per minute per token. The limit is a sliding window, so a burst does not lock you out for the rest of the minute.