Stape

Hosting for server-side Google Tag Manager and CAPI Gateway containers — stape.io.

Docs: https://api.app.stape.io/api/doc — Stape's own OpenAPI 3.0 spec, served from the API host itself and read from that page's embedded swagger-data. Not a third-party bundle. Overview: https://stape.io/solutions/api

Auth

An API key from Account settings → API Keys in app.stape.io, sent in the X-AUTH-TOKEN header — the spec's only security scheme. Available on all server-side GTM subscription plans.

X-WORKSPACE is an optional header for agency and partner accounts, so the connection is a custom auth with the workspace as a second, optional field rather than a hidden assumption. It is sent only when filled in; an empty one would be worse than none.

Actions

| Action | Endpoint | |---|---| | List Containers | GET /api/v2/containers | | Get Container | GET /api/v2/containers/{identifier} | | List Container Domains | GET /api/v2/containers/{container}/domains | | Add Container Domain | POST /api/v2/containers/{container}/domains | | Get Container Analytics | GET /api/v2/containers/{identifier}/analytics/info | | Get Outgoing Request Logs | GET /api/v2/containers/{identifier}/monitoring/logs/outgoing/aggregated | | List Monitoring Rules | GET /api/v2/containers/{identifier}/monitoring | | Get Power-Up Status | GET /api/v2/containers/{identifier}/power-ups/{type} |

Every route was probed with a bogus token and returns 401 (route real, credential rejected); /api/v2/definitely-not-a-route returns 404.

Triggers

| Trigger | How | |---|---| | New Container | Polls GET /api/v2/containers, deduped on the container identifier |

Stape's spec publishes no webhook subscription endpoint, so the trigger polls. Dedupe is LAST_ITEM on the identifier rather than TIMEBASED: the list response's date field is not documented, and guessing at one that turns out to be absent would make the trigger silently never fire. An identifier is present by definition — it is how every other endpoint addresses a container.

Read and operate, not provision

Creating a container is deliberately not an action. POST /api/v2/containers starts a paid subscription and requires two nested objects (zone, codeSettings) that the spec does not describe well enough to build a trustworthy form from. Provisioning billable infrastructure from a flow, through a form built on guesswork, is the wrong default — ai.instructions points the user at app.stape.io instead.

Notes

• Containers are addressed by identifier, not the numeric id. The Container dropdown returns the identifier, because passing the id 404s.
• Add Container Domain exposes one three-way DNS record choice, not the API's two separate useCnameRecord / useARecord booleans — two booleans let a caller set both or neither and get an unhelpful rejection. Leaving it blank sends neither flag rather than defaulting one to false, which would tell Stape something the user never said.
• Adding a domain does not make it live. Stape returns a DNS record the user must create themselves; List Container Domains shows the validation status afterwards.
• Container status is a dropdown fed by GET /api/v2/resources/container-statuses. The spec types status as a bare string with no enum, so a text box would have shipped an example value nobody had verified — and a wrong one silently filters every container out. Domain status stays free text, because Stape publishes no equivalent resources endpoint to populate it from.
• Log dates are entered as dates. The API wants Unix timestamps in seconds; the fields take 2026-08-01 (or a full timestamp) and convert, with To covering the whole of the day given.
• List responses are read as Hydra/API-Platform collections (hydra:member), with plain data / items and a last-resort any-array search as fallbacks — a wrong wrapper guess is otherwise indistinguishable from "you have no containers".