Vistoa

API docs

Article scoring infrastructure for teams.

Use Bearer authentication. Query-string API keys are rejected. Sandbox keys return deterministic data without touching quota, Stripe, or production records.

Open API consoleView plans

Quickstart

Read and score articles.

Read scored articles

curl -H "Authorization: Bearer opt_live_your_key" \
  https://vistoa.com/v1/articles?limit=10

Score a URL

Score requests are async. A new article score increments billable usage only after scoring completes.

curl -X POST https://vistoa.com/v1/articles/score \
  -H "Authorization: Bearer opt_live_your_key" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com/news/story"}'

curl -H "Authorization: Bearer opt_live_your_key" \
  https://vistoa.com/v1/articles/score/{score_request_id}

Integration

Keys, signatures, and errors.

Sandbox keys

Keys beginning with opt_test_ return deterministic sandbox data for score requests, common reads, and webhook tests.

Webhook signatures

Vistoa signs each delivery with HMAC-SHA256 over timestamp.body. Reject requests where X-Optiarms-Timestamp is more than five minutes off.
const signed = `${timestamp}.${rawBody}`;
const expected = "v1=" + crypto
  .createHmac("sha256", webhookSecret)
  .update(signed)
  .digest("hex");

Errors

Errors return { error: { code, message } }. Common B2B codes include missing_bearer_token, scope_forbidden, plan_forbidden, quota_exceeded, and rate_limit_exceeded.

Endpoint map

Available routes.

GET /v1/articles
POST /v1/articles/score
GET /v1/articles/score/{id}
GET /v1/articles/{id}
GET /v1/articles/by-url?url=...
GET /v1/outlets
GET /v1/outlets/{slug}
GET /v1/methodology/prompts
GET /v1/methodology/eval-runs
POST /v1/webhooks
GET /v1/webhooks
GET /v1/webhooks/{id}
PATCH /v1/webhooks/{id}
DELETE /v1/webhooks/{id}
POST /v1/webhooks/{id}/test
POST /v1/webhooks/{id}/replay
GET /v1/webhooks/{id}/deliveries
GET /v1/stream/articles
GET /v1/stream/clusters