Highlight (highlight.io)

Highlight Session Ingestion API

GraphQL-over-HTTP session replay ingestion endpoint at `https://pub.highlight.io` used by the `highlight.run` browser SDK to upload rrweb DOM snapshots, console/network recording, custom events, identify payloads, and error reports. Public, project-id authenticated, no user secrets required.

Highlight Session Ingestion API is one of 7 APIs that Highlight (highlight.io) publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

This API exposes 1 machine-runnable capability that can be deployed as REST, MCP, or Agent Skill surfaces via Naftiko and 1 JSON Schema definition.

Tagged areas include Observability, Session Replay, Ingestion, and GraphQL. The published artifact set on APIs.io includes API documentation, an OpenAPI specification, 1 Naftiko capability spec, and 1 JSON Schema.

GitHub OpenAPI

Documentation

📖
Documentation
https://www.highlight.io/docs/general/product-features/session-replay

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/highlight-io/refs/heads/main/openapi/highlight-session-ingestion-api-openapi.yml

Schemas & Data

📊
JSONSchema
https://raw.githubusercontent.com/api-evangelist/highlight-io/refs/heads/main/json-schema/highlight-session-schema.json

Other Resources

🔗
NaftikoCapability
https://raw.githubusercontent.com/api-evangelist/highlight-io/refs/heads/main/capabilities/session-ingestion.yaml

OpenAPI Specification

highlight-session-ingestion-api-openapi.yml Raw ↑ 
openapi: 3.1.0
info:
  title: Highlight Session Ingestion API
  description: >
    GraphQL-over-HTTP session replay ingestion endpoint used by the
    `highlight.run` browser SDK. Receives rrweb DOM snapshots, console and
    network recordings, custom events, identify payloads, and frontend errors.
    Authenticated by project verbose ID (public); no user secrets required.
  version: '1.0'
  contact:
    name: Highlight Support
    url: https://www.highlight.io/community
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
servers:
  - url: https://pub.highlight.io
    description: Highlight public ingestion endpoint
  - url: http://localhost:8082
    description: Self-hosted public ingestion endpoint
tags:
  - name: Sessions
    description: Browser session ingestion mutations
paths:
  /:
    post:
      summary: Execute Public Graph Mutation
      description: >
        Single GraphQL endpoint that accepts the SDK mutations
        `initializeSession`, `pushPayload`, `identifySession`, `addSessionFeedback`,
        `addSessionProperties`, `addTrackProperties`, `pushBackendPayload`, and
        `markBackendSetup`. Operation is determined by the `operationName` field
        in the JSON body.
      operationId: executePublicGraphMutation
      tags:
        - Sessions
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GraphQLRequest'
      responses:
        '200':
          description: GraphQL response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GraphQLResponse'
        '400':
          description: Invalid GraphQL payload.
        '429':
          description: Rate limited.
components:
  schemas:
    GraphQLRequest:
      type: object
      required: [query]
      properties:
        operationName:
          type: string
          description: >
            One of `initializeSession`, `pushPayload`, `identifySession`,
            `addSessionFeedback`, `addSessionProperties`, `addTrackProperties`,
            `pushBackendPayload`, `markBackendSetup`.
        query:
          type: string
        variables:
          type: object
          additionalProperties: true
          description: >
            Mutation variables. For `initializeSession` includes
            `organization_verbose_id`, `enable_strict_privacy`, `client_version`,
            `firstload_version`, `client_config`, `environment`, `appversion`,
            `fingerprint`, `client_id`, `network_recording_domains`. For
            `pushPayload` includes `session_secure_id`, `events`,
            `messages`, `resources`, `errors`, `payload_id`.
    GraphQLResponse:
      type: object
      properties:
        data:
          type: object
          additionalProperties: true
        errors:
          type: array
          items:
            type: object
            properties:
              message:
                type: string
              path:
                type: array
                items:
                  type: string
              extensions:
                type: object
                additionalProperties: true