Getting started

Make your first request to API V2 in a few minutes.

1. Choose the API server

All requests go to an API server, not to this documentation site. Use the Production API in your applications:

https://apiv2.virtualperformancetool.com

A Test API exists at https://apiv2test.virtualperformancetool.com for pre-release builds. It is not a sandbox: it shares the live production database with the Production API and API V1, so requests sent to it can read and change real data.

2. Check that the API is up

GET /v2/health needs no authentication.

curl https://apiv2.virtualperformancetool.com/v2/health

{
  "status": "ok",
  "service": "VPT API V2",
  "environment": "production",
  "apiVersion": "v2",
  "time": "2026-10-13T18:00:00+00:00"
}

The environment field tells you which deployment answered (production or test).

3. Get a token

Protected endpoints need an API V2 access token. API V2 sign-in is not available yet, so no token can be obtained today. Tokens and developer keys of API V1 are not accepted by API V2. See Authentication for how API V2 tokens work.

4. Call a protected endpoint

GET /v2/me describes the access token it receives.

curl https://apiv2.virtualperformancetool.com/v2/me \
  -H "Authorization: Bearer $VPT_TOKEN"

A valid access token returns the user, the application it was issued to, its scopes and its expiry:

{
  "userId": 42,
  "applicationId": "vpt_app_example",
  "scopes": ["profile:basic"],
  "tokenExpiresAt": "2026-11-12T18:00:00+00:00"
}

Today, before sign-in exists, a request without a token returns 401 (authentication_required) and a request with a token returns 503 (authentication_unavailable). See Errors.

5. Explore the reference

The API reference lists every endpoint with its parameters, responses and ready-to-copy examples, and lets you send requests from your browser.

Request conventions

• Use HTTPS. Requests and responses are JSON.
• Send the token as Authorization: Bearer <token> to protected endpoints only.
• Errors always use the format described in Errors.

Request IDs

Every response carries an X-Request-Id header, and every error body repeats it as requestId. Quote it when you report a problem. You may send your own X-Request-Id (8 to 64 characters from A-Z a-z 0-9 . _ -); otherwise one is generated.

Contract version

Responses include X-API-Contract-Version, the version of the OpenAPI contract that describes the API at that moment.

Client information (optional)

You can tell us about your client with these headers. They are used only for diagnostics and never change what the API returns.

Browsers

The API answers CORS preflight requests, so browser applications can call it directly.