Base URL
All API requests are made to your install’s URL — whatever public hostname you set during the first-run wizard:Authentication
The Ekso API uses Bearer token authentication. Include your JWT token in theAuthorization header of every request:
OAuth 2.0
Ekso implements OAuth 2.0 with the following endpoints:
Supported grant types:
authorization_code, refresh_token
Code challenge method: S256 (PKCE required)
Error handling
All error responses share a consistent shape:
The
fields array is only populated for Validation errors.
Versioning
The API supports versioning via multiple methods:
If no version is specified, the latest version is used.
Rate limits
API endpoints are rate-limited to 50 requests per second per IP address. When the limit is exceeded, the API returns HTTP429 Too Many Requests.
Response format
All responses use JSON (application/json). Successful responses return HTTP 200 with the data payload directly in the response body.