The GetAff API

What you can do with it

Version 1 exposes four reads. It allows no writes: no programme submission, no account change. That is deliberate — a read-only API has no destructive failure mode, and we would rather publish a narrow contract we will keep than a wide one we would walk back.

• Browse the public programme directory, filtered and paginated.
• Read a single programme by its identifier.
• Inspect your plan, your capabilities and your connected networks.
• Retrieve your commissions, filtered by date, network and status.

In three steps

1. Sign in, then create a key from the “API keys” page. It is shown exactly once.
2. Keep it server-side, in a secret manager or an environment variable.
3. Send it on every call, in the Authorization header.

First call

No other header is required. Responses are always UTF-8 encoded JSON.

curl -s 'https://getaff.org/api/v1/programs?vertical=saas&minScore=60&limit=2' \
  -H 'Authorization: Bearer gaff_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'

Response

{
  "data": [
    {
      "slug": "northstack-northstack",
      "name": "NorthStack",
      "host": "northstack.io",
      "site": "https://northstack.io",
      "pitch": "Managed Postgres for teams that ship on Fridays. Free tier, usage billing.",
      "vertical": "saas",
      "model": "recurring",
      "commission": "25% recurring",
      "recurring": true,
      "cookieDays": 90,
      "payout": "monthly",
      "minPayout": 50,
      "markets": [
        "FR",
        "BE",
        "CH",
        "DE"
      ],
      "platform": "in-house",
      "signupUrl": "https://northstack.io/partners",
      "score": 78,
      "image": "",
      "createdAt": "2026-03-11T09:24:00.000Z"
    }
  ],
  "page": {
    "limit": 2,
    "hasMore": true,
    "nextCursor": "Wzc4LCJ2SzlxIl0"
  }
}

Pagination

Collections are cursor-paginated, never offset-paginated. Pass page.nextCursor back verbatim as cursor. The cursor is opaque: its contents may change without notice, its meaning will not.

Versioning

The version is part of the path. For as long as /v1 exists, no field will disappear from it and no required field will be added: we may add optional fields, never remove them. A breaking change would become /v2, served alongside. Write clients that ignore fields they do not know.

Machine-readable specification

The OpenAPI 3.1 document is derived from the same schemas the routes enforce: it cannot describe anything other than what is actually validated. Use it to generate a client.