REST API Reference

# Login

curl -X POST https://api.fusillade.io/api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com", "password": "..."}'

# Response: { "token": "eyJ...", "user": { ... } }

curl https://api.fusillade.io/api/v1/me \
  -H "Authorization: Bearer eyJ..."

# Create API key

curl -X POST https://api.fusillade.io/api/v1/keys \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"name": "CI Agent", "scopes": ["test:create"]}'

# Response: { "key": "fusi_abc123...", "id": "...", "name": "CI Agent", "scopes": ["test:create"] }

# Error response format

{
  "error": "Worker limit exceeded. Your plan allows up to 1000 workers.",
  "code": "worker_limit_exceeded"
}

# Idempotent request

curl -X POST https://api.fusillade.io/api/v1/tests \
  -H "Authorization: Bearer <token>" \
  -H "Idempotency-Key: my-unique-key-123" \
  -F "name=Load Test" \
  -F "script=@test.js" \
  -F "workers=100" \
  -F "duration=60"

# Example

curl -X POST "https://api.fusillade.io/api/v1/tests" \
  -H "Authorization: Bearer <token>" \
  -F "name=API Load Test" \
  -F "script=@test.js" \
  -F "workers=100" \
  -F "duration=60" \
  -F "region=eu-hel1"

# Response (201):
{
  "test_id": "550e8400-e29b-41d4-a716-446655440000",
  "status": "provisioning"
}

# Wait for provisioning

# Blocks until workers are provisioned (up to 5 min timeout)
curl -X POST "https://api.fusillade.io/api/v1/tests?wait=true" \
  -H "Authorization: Bearer <token>" \
  -F "name=CI Test" \
  -F "script=@test.js" \
  -F "workers=50" \
  -F "duration=60"

# Response (201) -- returned once status is "ready":
{
  "test_id": "550e8400-...",
  "status": "ready"
}

# Wait for full completion (timeout: 30 min)
curl -X POST "https://api.fusillade.io/api/v1/tests?wait=true&wait_for=completed" \
  -H "Authorization: Bearer <token>" \
  -F "name=CI Test" \
  -F "script=@test.js" \
  -F "workers=50" \
  -F "duration=60"

provisioning -> ready -> pending -> running -> completed / failed
                  |                    |
                  v                    v
               cancelled            stopped

# Compare against baseline

curl "https://api.fusillade.io/api/v1/tests/<current_id>/compare/<baseline_id>" \
  -H "Authorization: Bearer <token>"

# Response:
{
  "baseline": {
    "name": "API Load Test v1.2",
    "status": "completed",
    "workers": 100,
    "duration_seconds": 60,
    "region": "eu-hel1",
    "avg_latency_ms": 42.5,
    "p95_latency_ms": 89.2,
    "error_rate": 0.001,
    "rps": 1250.0,
    "total_requests": 75000
  },
  "current": {
    "name": "API Load Test v1.3",
    "status": "completed",
    "workers": 100,
    "duration_seconds": 60,
    "region": "eu-hel1",
    "avg_latency_ms": 48.1,
    "p95_latency_ms": 102.4,
    "error_rate": 0.002,
    "rps": 1180.0,
    "total_requests": 70800
  },
  "delta": {
    "avg_latency_ms": 5.6,
    "p95_latency_ms": 13.2,
    "error_rate": 0.001,
    "rps": -70.0
  },
  "regression": true,
  "regression_reasons": [
    "p95 latency increased 14.8%"
  ]
}

# GitHub Actions snippet

# Run test, wait for completion, check for regression
TEST_ID=$(curl -s -X POST "https://api.fusillade.io/api/v1/tests?wait=true&wait_for=completed" \
  -H "Authorization: Bearer $FUSILLADE_API_KEY" \
  -F "name=CI Run #$GITHUB_RUN_NUMBER" \
  -F "script=@loadtest.js" \
  -F "workers=50" \
  -F "duration=60" | jq -r '.test_id')

REGRESSION=$(curl -s "https://api.fusillade.io/api/v1/tests/$TEST_ID/compare/$BASELINE_ID" \
  -H "Authorization: Bearer $FUSILLADE_API_KEY" | jq -r '.regression')

if [ "$REGRESSION" = "true" ]; then
  echo "Performance regression detected"
  exit 1
fi

# Create webhook

curl -X POST https://api.fusillade.io/api/v1/webhooks \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://your-server.com/webhook",
    "events": ["test.completed", "test.failed", "test.ready"]
  }'

# Response (201):
{
  "id": "...",
  "url": "https://your-server.com/webhook",
  "events": ["test.completed", "test.failed", "test.ready"],
  "secret": "whsec_...",
  "active": true,
  "created_at": "2026-02-06T12:00:00Z"
}

# Webhook delivery

{
  "event": "test.completed",
  "timestamp": "2026-02-06T12:00:00Z",
  "data": {
    "test_id": "550e8400-...",
    "name": "API Load Test",
    "status": "completed",
    "workers": 100,
    "duration_seconds": 60,
    "p95_latency_ms": 42,
    "error_rate": 0.001,
    "target_urls": ["https://api.example.com"],
    "threshold_results": null
  }
}

# Verify signature (Node.js)

const crypto = require('crypto');

function verifyWebhook(body, signature, secret) {
  const [tPart, vPart] = signature.split(',');
  const timestamp = tPart.replace('t=', '');
  const expectedSig = vPart.replace('v1=', '');

  const payload = timestamp + '.' + body;
  const computed = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(computed),
    Buffer.from(expectedSig)
  );
}

# Create template

curl -X POST https://api.fusillade.io/api/v1/templates \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "API Smoke Test",
    "description": "Quick smoke test for the main API",
    "script_content": "export const options = { workers: 10, duration: "30s" };\nexport default function() { http.get("https://api.example.com/health"); }",
    "workers": 10,
    "duration_seconds": 30,
    "region": "eu-hel1"
  }'

# Run template with overrides

curl -X POST https://api.fusillade.io/api/v1/templates/<template_id>/run \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"workers": 50, "duration_seconds": 120}'

# Response: same as POST /api/v1/tests
{
  "test_id": "...",
  "status": "provisioning"
}

# Create schedule

curl -X POST https://api.fusillade.io/api/v1/schedules \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Nightly API Test",
    "script_content": "export default function() { http.get("https://api.example.com/health"); }",
    "workers": 50,
    "duration_seconds": 60,
    "region": "eu-hel1",
    "cron_expression": "0 0 2 * * * *",
    "timezone": "UTC"
  }'

# Cron format: sec min hour day_of_month month day_of_week year (7 fields)
# "0 0 2 * * * *"       -- daily at 2:00 AM
# "0 0 */6 * * * *"     -- every 6 hours
# "0 0 9 * * Mon *"     -- every Monday at 9:00 AM
# "0 0 0 1 * * *"       -- first day of each month

# Get trends

curl "https://api.fusillade.io/api/v1/analytics/trends?metric=p95&period=30d" \
  -H "Authorization: Bearer <token>"

curl "https://api.fusillade.io/api/v1/analytics/trends?target_url=https://api.example.com&metric=error_rate&period=7d" \
  -H "Authorization: Bearer <token>"

# Connect (Browser)

// Pass token via Sec-WebSocket-Protocol header as ['auth', '<token>']
const ws = new WebSocket(
  'wss://api.fusillade.io/ws/runs/<test_id>',
  ['auth', '<your_jwt_token>']
);

ws.onmessage = (event) => {
  const data = JSON.parse(event.data);
  // data.type: "metric" | "status" | "summary"
  console.log(data);
};

# Connect (CLI / server-side)

// Query parameter fallback for non-browser clients
// wss://api.fusillade.io/ws/runs/<test_id>?token=<jwt_token>