Developers

Checkpoint’s web app is a thin client over an HTTP API, and that same API is open to you. There is no separate developer signup and no API key — an ordinary Checkpoint account is what you authenticate with.

Base URLs

Environment	Base URL
Production	https://api.checkpointrun.com
Test	https://dev.api.checkpointrun.com

Build against the test environment. It runs the same code a little ahead of production, and its data is disposable — it can be wiped without notice, which is exactly what you want while you’re experimenting.

Browse the API

Every environment serves its own OpenAPI description, and a browser for it:

• /swagger — every endpoint, its parameters and its responses, with a “try it out” button
• /swagger/v1/swagger.json — the raw OpenAPI document, which most client generators will take as-is

The documentation is public. The operations it describes are not: each one still enforces exactly the same permissions as the app, so being able to read about an endpoint doesn’t mean you can call it.

Authenticating

Post your Checkpoint email and password and you get a bearer token back:

curl -X POST https://api.checkpointrun.com/login \
  -H 'content-type: application/json' \
  -d '{"email":"you@example.com","password":"your-password"}'

{ "tokenType": "Bearer", "accessToken": "…", "expiresIn": 3600, "refreshToken": "…" }

Send it on every subsequent call:

curl https://api.checkpointrun.com/api/me/alerts \
  -H "Authorization: Bearer $ACCESS_TOKEN"

The access token lasts an hour. To get a fresh pair without asking for the password again, post the refresh token to /refresh:

curl -X POST https://api.checkpointrun.com/refresh \
  -H 'content-type: application/json' \
  -d '{"refreshToken":"…"}'

The web app signs in through the same endpoint with ?useCookies=true and gets a session cookie instead. That path is for browsers on Checkpoint’s own domains; as an API client, use the token.

What you can read without signing in

Public content needs no token at all: the events list, public courses, clubs and maps, and event leaderboards. Anything private, anything about you, and every write needs one.

Rate limits

100 requests per minute — counted per account once you’re authenticated, and per IP address before that. Going over returns 429; the window is fixed, so waiting for it to roll over is enough.

Worth knowing before you start

• Enums are strings, not numbers. An event’s status comes back as "Finalized", a registration’s as "Waitlisted". Comparing against a number silently never matches — a mistake we have made ourselves.
• Timestamps are ISO-8601 with an offset, in UTC, e.g. 2026-08-14T20:28:26.335649+00:00.
• The API is not versioned yet, and the contract can change. It is the same API the app uses, so it moves when the app does. Re-read the OpenAPI document after an update rather than pinning to what you saw once.
• Browser apps on other domains can’t call it. CORS allows only Checkpoint’s own front ends, so call the API from a server, a script, or a native app rather than from someone else’s web page.

Share links

Events, courses, clubs, maps and published results also have short public links on https://go.checkpointrun.com, which render a preview card when pasted into a chat app and redirect a real browser into Checkpoint.

Asking for more

If you need an endpoint that doesn’t exist, or a guarantee we don’t yet offer, say so on the feedback board — it’s the same place feature requests go, and it’s read.