API reference

Everything you need to schedule HTTP requests, fire one-shot delayed messages, and publish to durable queues. New to CronPilot? Start with the quickstart.

The base URL is https://cronpilot.dev. Every request carries a Bearer token (cp_sk_…) created in Settings → API Keys. A missing, placeholder, invalid, or revoked key returns 401 with a descriptive message.

Recurring HTTP requests driven by cron expressions. Each firing creates a message in the durable log. Full CRUD lives under /v1/schedules (GET, POST, GET /:id, PUT /:id, DELETE /:id); the create call is documented below.

curl -X POST "https://cronpilot.dev/v1/schedules" \
  -H "Authorization: Bearer <API_KEY>" \
  -H "Content-Type: application/json" \
  -d {
       "name": "Cleanup stale sessions",
       "cron": "0 */6 * * *",
       "url": "https://api.example.com/cleanup",
       "method": "POST",
       "timezone": "America/New_York"
     }'

One-shot HTTP requests delivered after a delay or at a specific time. Returns 202 Accepted — once accepted, the message is durable and will be delivered even if our infrastructure restarts.

curl -X POST "https://cronpilot.dev/v1/messages" \
  -H "Authorization: Bearer <API_KEY>" \
  -H "Content-Type: application/json" \
  -d {
       "url": "https://api.example.com/send-reminder",
       "delay": 3600,
       "deduplication_id": "reminder-u_123-2026-05-29"
     }'

Named queues with configurable concurrency. At concurrency: 1, messages are delivered strictly in order. Queues default to 3 retries — the semantic is "publish means deliver." Manage them under /v1/queues and publish to /v1/queues/{name}/messages.

curl -X POST "https://cronpilot.dev/v1/queues" \
  -H "Authorization: Bearer <API_KEY>" \
  -H "Content-Type: application/json" \
  -d {
       "name": "email-sends",
       "concurrency": 5
     }'

curl -X POST "https://cronpilot.dev/v1/queues/:name/messages" \
  -H "Authorization: Bearer <API_KEY>" \
  -H "Content-Type: application/json" \
  -d {
       "url": "https://api.example.com/send-email",
       "body": "{ \"to\": \"user@example.com\", \"template\": \"welcome\" }"
     }'

A target group is a named set of HTTPS endpoints. Pass its id as default_target_group_id on a queue or message and a single publish fans out to every member — each delivery is tracked and retried independently. Members are validated through the same HTTPS-only, SSRF-guarded checks as any other target.

curl -X POST "https://cronpilot.dev/v1/target-groups" \
  -H "Authorization: Bearer <API_KEY>" \
  -H "Content-Type: application/json" \
  -d {
       "name": "regional-webhooks"
     }'

curl -X POST "https://cronpilot.dev/v1/target-groups/:id/members" \
  -H "Authorization: Bearer <API_KEY>" \
  -H "Content-Type: application/json" \
  -d {
       "target_url": "https://eu.example.com/hook",
       "method": "POST"
     }'

To prevent abuse, target domains must be verified before you can send unlimited messages to them. Unverified domains are limited to 10 messages per day per domain; verified domains use your full tier quota. Verifying a registrable domain covers all of its subdomains.

curl -X POST "https://cronpilot.dev/v1/domains" \
  -H "Authorization: Bearer <API_KEY>" \
  -H "Content-Type: application/json" \
  -d {
       "domain": "api.example.com"
     }'

When a signing secret is configured (per schedule or queue), every outbound request includes three verification headers. Compute the expected signature over {timestamp}.{rawBody}, compare in constant time, and reject timestamps older than five minutes.

{
  "method":  "POST",
  "url":     "https://api.example.com/cleanup",
  "headers": { "X-CronPilot-Message-Id": "msg_8RXc1Pm9k" },
  "body":    "{ \"run\": \"cleanup\" }"
}

import { createHmac } from "crypto";

function verify(req, secret) {
  const sig  req.headers["x-cronpilot-signature"]; // v1=<hex>
  const ts   req.headers["x-cronpilot-timestamp"]; // unix seconds
  if (Math.abs(Date.now()  1000  Number(ts))  300) return false;

  const expected  "v1="  createHmac("sha256", secret)
    .update(ts  "."  req.body)  // raw, unparsed body
    .digest("hex");
  return sig  expected;
}

Every error returns JSON with an error field; quota and domain-limit errors add structured fields (window, limit, used).

tip See the live numbers and upgrade on the pricing page.