Automate kitty with the API and webhooks

Authentication

The same key as MCP. Settings → Security → API keys (MCP) → Create key, then:

Authorization: Bearer kitty_sk_your_key

Header only — never a query parameter. Rate limit: 120 requests per minute per key.

The endpoints

Base URL https://kitty.build/api/v1.

Method and path	What it does
GET /me	Connection test — returns the workspace and who the key acts as
GET /ventures	Ventures this key may act on
GET /actions	The catalogue of engine actions
POST /ventures/:id/actions/:key	Invoke one action (accepts an Idempotency-Key header)
GET /ventures/:id/tasks/:taskId	Poll a task, including one waiting for approval
GET /hooks · POST /hooks · DELETE /hooks/:id	Manage webhook subscriptions
GET /events/sample?type=...	Sample payloads, for building against

Start with GET /me — if that returns your workspace, the key is good.

The approval gate holds

Invoking an approval-gated action does not bypass approval. You get back needs_approval and a message telling you it is waiting for a human in the venture's approval queue, plus the task id to poll. Automation cannot make kitty publish, spend or send on its own — that is the design, not a limitation to work around.

Webhooks

Add them in Settings → Connections → Event webhooks → Add webhook. Pick the platform (Make.com, n8n, Zapier, or a custom URL), paste the URL, and choose events — selecting none means all of them.

Eight event types:

task.needs_approval · task.needs_founder · run.completed · milestone.reached · metric.synced · venture.status_changed · briefing.weekly · lead.captured

Verify the signature. Every delivery carries X-Kitty-Signature: sha256=<hex>, an HMAC-SHA256 of the raw request body using the secret shown once when you create the subscription. Compute it over the raw bytes, before any JSON parsing.

A subscription that fails 10 times in a row is disabled automatically, so a dead endpoint does not retry forever.

Firing an outbound automation costs a nominal 1 Treats. Receiving lifecycle event webhooks is free — charging you for a notification would punish you for connecting in the first place.

What is not there

Said plainly so you build against reality: there is no Zapier app, no n8n community node and no Make custom app. You connect using their generic webhook and HTTP-request blocks, which works fine and is what the event format is designed for. There is also no general read/write REST API over all venture data, and no polling endpoint for past events — webhooks are the delivery mechanism.

If a packaged integration would make the difference for you, tell us; that demand is what would build it.