List Dynamic URLs
Authorization
ApiKeyAuth API key from Settings → API Keys.
In: header
Query Parameters
Response Body
application/json
curl -X GET "https://example.com/api/v1/dynamic_urls"{ "object": "list", "data": [ { "id": "cmtd1x9k80001js04q2v9k3m0", "object": "dynamic_url", "name": "Cohort 2026 certificates", "token": "abc123def456ghij", "template_id": "cm4tpl8e20001js04xq2v9k3m", "template_name": "Course Certificate", "mode": "encoded", "security": "signed", "status": "active", "formats": [ "pdf" ], "render_count": 412, "cache_ttl": 86400, "base_url": "https://dyn.automette.com/d/abc123def456ghij/course-certificate.pdf", "secrets": [ { "slot": 1, "label": "Primary", "revoked_at": null, "last_used_at": "2026-08-29T04:11:00.000Z" } ] } ]}Get a render GET
Returns the current status of a render. Poll this endpoint after an async `POST /api/v1/renders` until `status` is `completed` or `failed`. **`status`** transitions: `pending` → `running` → `completed` or `failed`. While not `completed`, `url` is `null`. **`error`** is populated when `status` is `failed`. Truncated to 500 characters. **`webhook_deliveries`** lists every attempt to deliver a webhook for this render, including retries. `source` is `render_webhook` (per-request `webhook_url`) or `global_webhook` (subscription). `null` if no deliveries have been attempted yet. **Download mode** — add `?download=true` to redirect directly to the file. Unlike `url`, this address is permanent, which makes it the right thing to put in an `<a href>` or use with `curl -OL`. It is gated on the same auth as this endpoint, so it works for your own requests and for a logged-in dashboard user, but it is not shareable with a third party — use `url` for that. When multiple formats were requested, add `?format=pdf`, `?format=png`, etc. to pick which file to download. Defaults to the first file if omitted.
Create a Dynamic URL POST
Gives a template one permanent, embeddable address. The data travels in the URL, signed, and the document is rendered the first time someone asks for it — no API call per document. **One Dynamic URL serves every recipient.** The same address renders a certificate for each student or an invoice for each customer; only the payload differs. Create a second one when you want separate controls — its own expiry, or a signing secret revocable without touching the first — never one per recipient. The response includes the signing secret and a `sample_url` that renders as-is. The secret is derived rather than stored, so it can be read again later with `include_secret=true` — losing it does not force a rotation. **Signing your own:** HMAC-SHA256 over `{token}/{extension}?{query}`, with the query sorted and `s` left out. No hostname and no path, so a signature survives the URL moving.