Developers
Arknox developer resources
The Arknox developer portal: API docs, a public REST API, an OpenAPI spec, outbound webhook events, payload shapes, signature verification, and embed code for every framework.
API docs & reference formats
- —OpenAPI 3.1 spec — machine-readable schemas for both the public REST API and webhook payloads
- —llms.txt — full product reference for AI agents and LLM tools
- —Integration guide — embed code snippets for every platform (HTML, React, Next.js, WordPress, Shopify, and more)
Public REST API
The same unauthenticated endpoints the Arknox embed player itself calls — scoped to a single public video, playlist, or overlay token, not an account-wide API key. Every response carries an API-Version header; full request/response schemas and error shapes are in the OpenAPI spec.
| Endpoint | Purpose |
|---|---|
| GET /api/videos/{token}/embed-config | Video overlay configuration |
| POST /api/responses/{quiz,poll,form,booking} | Submit an overlay response |
| GET /api/public/playlist/{id} | Public playlist metadata and video list |
| POST /api/public/password-gate/{token}/verify | Unlock a password-gated video or playlist |
| POST /api/public/manual-purchase/create | Request access to a paywalled playlist |
Rate-limited endpoints return RateLimit-* headers plus Retry-After on a 429. Every 4xx/5xx response is JSON — { "message": "..." }, never an HTML error page.
Webhooks
Configure a webhook URL under Settings → Webhooks in your dashboard. Arknox sends an HTTP POST with a JSON body for every subscribed event:
{
"event": "form.submitted",
"timestamp": "2026-08-23T09:00:00.000Z",
"data": { "...": "event-specific fields" }
}Events
| Event | Fires when |
|---|---|
| form.submitted | A lead capture, gate, or overlay form was submitted |
| quiz.submitted | A viewer answered a multiple-choice quiz question |
| poll.submitted | A viewer answered a poll |
| booking.submitted | A booking widget was submitted |
| note.created | A timestamped viewer note was created |
| video.duplicated | A video was duplicated in the dashboard |
| video.expired | An embed link's expiry date passed |
Verifying the signature
If a secret is set on the webhook, every request carries an X-Webhook-Signature header — sha256=<hex>, an HMAC-SHA256 of the raw request body keyed with your secret. The event name is also sent unsigned as X-Webhook-Event for routing. Verify with a constant-time comparison before trusting the payload:
| import crypto from 'crypto' |
| function isValidSignature(rawBody: string, header: string, secret: string) { |
| const expected = crypto |
| .createHmac('sha256', secret) |
| .update(rawBody) |
| .digest('hex') |
| return header === `sha256=${expected}` |
| } |
Deliveries time out after 8 seconds and are not retried — respond with any 2xx status as soon as the payload is accepted. Works directly as a Zapier "Catch Hook" trigger, or with Make, n8n, and any HTTP-capable automation platform.
Embed integration
Arknox embeds are a standard <iframe> — no SDK or API key required client-side. See the full integration guide for framework-specific snippets, or the embed generator for a no-signup quick start.
Questions?
Reach the Arknox team at support@arknox.in or through the support center.