Skip to main content

Base URL

All API requests are made to your install’s URL — whatever public hostname you set during the first-run wizard:
Self-host has no concept of a tenant subdomain — every install is its own single addressable identity.

Authentication

The Ekso API uses Bearer token authentication. Include your JWT token in the Authorization header of every request:
Tokens are obtained via the OAuth 2.0 authorization code flow with PKCE.

OAuth 2.0

Ekso implements OAuth 2.0 with the following endpoints: Supported grant types: authorization_code, refresh_token Code challenge method: S256 (PKCE required)

Error handling

All error responses share a consistent shape:
The fields array is only populated for Validation errors.

Versioning

The API supports versioning via multiple methods: If no version is specified, the latest version is used.

Rate limits

API endpoints are rate-limited to 50 requests per second per IP address. When the limit is exceeded, the API returns HTTP 429 Too Many Requests.

Response format

All responses use JSON (application/json). Successful responses return HTTP 200 with the data payload directly in the response body.