Authentication
Create a token in Settings → API. Tokens are scoped to one workspace and carry a role: read, write or admin. The secret is shown once. Send it on every request.
Authorization: Bearer rd_live_9f2c…
Base URL: https://api.redirectduck.com/v1
Requests over plain HTTP are refused, not redirected. Rotate a token from the same screen; the old one stays valid for one hour so deploys overlap safely.
Endpoints
Collections are paginated with limit and cursor, newest first, 50 per page by default.
GET
/v1/redirects
List rules, filterable by domain, status or tag.
POST
/v1/redirects
Create a rule. Validated for loops and conflicts before it goes live.
GET
/v1/redirects/{id}
Fetch a single rule with its 30-day hit count.
PATCH
/v1/redirects/{id}
Update destination, code or the path and query switches.
DELETE
/v1/redirects/{id}
Remove a rule. Traffic falls through to the domain fallback.
POST
/v1/redirects/test
Send a URL, get the rule that would match and the final location.
POST
/v1/imports
Upload a CSV or a JSON array. Returns a report with rejected rows.
GET
/v1/domains
List domains with verification state, zone and certificate expiry.
GET
/v1/analytics
Hits by rule, day, country or referrer, within your retention window.
The redirect object
FieldType
idstring
Prefixed with rd_, stable for the life of the rule.
sourcestring
Hostname with an optional path pattern or wildcard.
destinationstring
Absolute URL. Capture groups $1…$9 are substituted.
codeinteger
301, 302, 307 or 308.
keep_pathboolean
Append the incoming path to the destination.
keep_queryboolean
Merge the incoming query string into the destination.
statusenum
pending_dns, live, paused or error.
zoneenum
us or eu, inherited from the domain.
201 Created
{
"id": "rd_7Kq2m",
"source": "oldbrand.com/*",
"destination": "https://newbrand.io/$1",
"code": 301,
"keep_path": true,
"keep_query": true,
"status": "live",
"zone": "eu",
"hits_30d": 12417,
"created_at": "2026-09-18T09:14:02Z"
}
Rate limits
Limits apply per token, per minute. Every response carries X-RateLimit-Remaining and X-RateLimit-Reset. Redirect traffic itself is never rate limited.
FREE
60
requests / minute
Bulk: 1 import / day
STARTER
300
requests / minute
Bulk: 10 imports / day
PRO
1,200
requests / minute
Bulk: unlimited
AGENCY
3,000
requests / minute
Bulk: unlimited
Errors
Errors return a machine-readable code, a human message and, for validation failures, the offending field.
HTTPcodeWhen it happens
400invalid_requestA field is missing or malformed. The field name is returned.
401invalid_tokenToken missing, revoked or from another workspace.
403insufficient_scopeA read token attempted a write, or the plan lacks the feature.
409rule_conflictAn identical source already exists, or the rule creates a loop.
422domain_not_verifiedThe domain has no valid DNS record yet.
429rate_limitedToo many requests. Retry after the seconds given in the header.
OpenAPI spec and Postman collection
Generated from the same schema the API validates against, updated on every release.