Cikit

Developers

Open API

Use this service from your own systems. All endpoints live at https://cikit.de.

Links

POST/api/links

Create a short link in your session. Omit code for a random 8-character one.

targetUrlDestination, http(s) only, max 2048 chars (required).
codeCustom code, [a-zA-Z0-9_-], 2–64 chars (optional).
Request
curl -X POST https://cikit.de/api/links \
  -H 'X-Session-ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' \
  -H 'Content-Type: application/json' \
  -d '{
    "targetUrl": "https://example.com/very/long/path",
    "code": "launch-day"
  }'
Response · 201
{
  "id": 42,
  "code": "launch-day",
  "targetUrl": "https://example.com/very/long/path",
  "clicks": 0,
  "createdAt": 1790255774,
  "updatedAt": 1790255774
}

Errors: 401 bad session · 400 invalid input or reserved code · 409 code already exists.

GET/api/links?limit=…&cursor=…

List links in your session, newest first, with cursor pagination.

limitPage size, 1–50, default 20 (optional).
cursorOpaque nextCursor from the previous page (optional).
Request
curl 'https://cikit.de/api/links?limit=20' \
  -H 'X-Session-ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'
Response · 200
{
  "items": [
    {
      "id": 42,
      "code": "launch-day",
      "targetUrl": "https://example.com/very/long/path",
      "clicks": 17,
      "createdAt": 1790255774,
      "updatedAt": 1790255774
    }
  ],
  "nextCursor": "MTc5MDI1NTc3NDo0Mg"
}

Pass nextCursor back as cursor for the next page; null means you reached the end. Invalid cursors return 400.

GET/api/links/:code

Fetch one of your session's links, including its click count. Other sessions' codes return 404 (no existence oracle).

Response · 200
{
  "id": 42,
  "code": "launch-day",
  "targetUrl": "https://example.com/very/long/path",
  "clicks": 17,
  "createdAt": 1790255774,
  "updatedAt": 1790255774
}
PATCH/api/links/:code

Update the destination and/or code of one of your session's links. Provide at least one field; changing either clears the redirect cache.

Request
curl -X PATCH https://cikit.de/api/links/launch-day \
  -H 'X-Session-ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' \
  -H 'Content-Type: application/json' \
  -d '{"targetUrl": "https://example.com/v2"}'

Errors: 401 · 400 invalid input or nothing to update · 404 not yours · 409 code taken.

DELETE/api/links/:code

Delete one of your session's links. The redirect cache entry is dropped immediately.

Response · 200
{ "ok": true }

Redirect

GET/:code

Resolve a short code with a 302 redirect and increment its click counter. Hot codes are served from cache; the counter still increments on every hit. No authentication needed.

Example
curl -v https://cikit.de/launch-day

< HTTP/1.1 302 Found
< Location: https://example.com/very/long/path
< X-Target-Cache: HIT

Unknown codes return 404. Reserved words (api, assets, manage, developers, …) fall through to the app router instead.

Rules & limits

Authentication“X-Session-ID: <session-id>” on every /api call. Missing or malformed sessions return 401.
Quota600 requests/minute per session on /api — exceeding it returns 429.
CORSFully open: any origin may call /api/* from browsers (preflight handled).
VersioningUnversioned stable paths; any breaking change ships under a new versioned prefix.
Codes[a-zA-Z0-9_-], 2–64 chars, globally unique. Omitted on create → random 8-char code. Reserved words cannot be used.
Target URLshttp:// or https:// only, max 2048 characters.
ErrorsAll errors are JSON: { "error": "<message>" } with the matching status code.
Windows shellExamples use bash-style \ line continuations. In PowerShell use ` instead, or join each example into a single line.
SecurityResponses carry nosniff, DENY framing, no-referrer, a locked-down permissions policy, HSTS on https, and a strict CSP.

Prefer the UI? Manage your links