API overview

Outlap exposes two JSON-over-HTTPS APIs. Both authenticate with an API key that belongs to a club or track, and both run as edge functions behind the same host.

Base URLs

Every path in this reference is relative to its API’s base URL. /v1/events/{eventId}/laps on the Live Timing API is https://fzfstcyowovukscxgdrh.supabase.co/functions/v1/timing-api/v1/events/{eventId}/laps.

Make your first request

Public endpoints need no key. This reads the standings for any event with public visibility:

curl https://fzfstcyowovukscxgdrh.supabase.co/functions/v1/timing-api/v1/events/EVENT_ID/leaderboard

const res = await fetch("https://fzfstcyowovukscxgdrh.supabase.co/functions/v1/timing-api/v1/events/EVENT_ID/leaderboard");
const { results } = await res.json();
console.log(results[0]); // { position: 1, best_lap_time: "1:32.345", ... }

import requests

results = requests.get("https://fzfstcyowovukscxgdrh.supabase.co/functions/v1/timing-api/v1/events/EVENT_ID/leaderboard").json()["results"]
print(results[0])

To write data you need a key. Follow the quickstart to mint one and post your first lap.

What’s in the box

• Versioned paths. Everything lives under /v1. Breaking changes will arrive as /v2 alongside it.
• JSON everywhere, except the ICS calendar endpoints, which return text/calendar.
• CORS is open (Access-Control-Allow-Origin: *) so public read endpoints work from a browser. Never ship an API key to a browser.
• Machine-readable specs. Download OpenAPI 3.1 documents from OpenAPI specs.
• AI-ready. /llms.txt indexes these docs and the MCP server exposes your account to assistants.

Next

1. Authentication: keys, scopes, and what each can touch.
2. Errors and rate limits: what to expect when things go wrong.
3. Conventions: units, IDs and timestamps.