Public Cars API

Create a key

1. Sign in to autolink as the organization owner and open Connections.
2. In Website / API, click Create API key and give it a name, for example "Company website".
3. Copy the key and store it on your server. It is shown only once.

Keys start with alk_live_. You can have up to 10 active keys per organization and revoke any of them at any time on the same page. A revoked key stops working on its next request.

Which cars are returned

A car is returned only when both of these are true:

1. The car's status is In stock or Reserved.
2. Its publication on Internal website has the status Active.

An active publication on any other portal never makes a car appear in the API.

Publish a car

1. In autolink open Listings.
2. Find the car. In the Internal website column click Publish (or Resume if it is Paused).
3. The status becomes Active and the car appears in the API on the next request.

To take a car off your website, open the status menu in the same cell and choose Pause or Remove, or mark the car Sold or Archived. It disappears on the next request.

Authentication

Send the key in the Authorization header:

Authorization: Bearer alk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Keys in the URL (?key=...) are rejected. Call the API from your server, never from browser code.

List cars

GET https://www.autolink.sk/api/public/v1/cars

curl "https://www.autolink.sk/api/public/v1/cars?limit=20" \
  -H "Authorization: Bearer $AUTOLINK_API_KEY"

const response = await fetch('https://www.autolink.sk/api/public/v1/cars?limit=20', {
  headers: { Authorization: `Bearer ${process.env.AUTOLINK_API_KEY}` },
});

const { data, next_cursor } = await response.json();

Response:

{
  "data": [
    {
      "id": "0b6c3a52-6f3e-4a35-9d3e-2a6f0f3b1c10",
      "brand": "Skoda",
      "model": "Octavia",
      "variant": "2.0 TDI Style",
      "year": 2021,
      "first_registration": "2021-03-15",
      "mileage_km": 64200,
      "power_kw": 110,
      "engine_l": 2.0,
      "engine_ccm": 1968,
      "fuel": "diesel",
      "transmission": "automatic",
      "body": "combi",
      "color": "grey",
      "color_name": "Moon white",
      "emission": "EU6d",
      "drive": "fwd",
      "doors": 5,
      "seats": 5,
      "equipment": [],
      "asking_price": 18900,
      "currency": "EUR",
      "status": "in_stock",
      "description": "First owner, service history.",
      "photos": [],
      "updated_at": "2026-10-20T09:15:00.123456+00:00"
    }
  ],
  "next_cursor": "WyIyMDI2LTEwLTIwVDA5OjE1OjAwLjEyMzQ1NiswMDowMCIsIjBiNmMzYTUyLTZmM2UtNGEzNS05ZDNlLTJhNmYwZjNiMWMxMCJd"
}

Cars are sorted by updated_at, newest first. When next_cursor is null, there are no more pages.

Get one car

GET https://www.autolink.sk/api/public/v1/cars/{id}

Returns { "data": { ...car } }. A car that does not exist, belongs to another organization or is not published answers 404.

Fields

Errors

Errors are JSON: { "error": "<code>" }.

Limits

Each key may make about 120 requests per minute. An address that keeps sending wrong keys is answered with 429 for a minute, before the key is even checked. Responses are not cacheable (Cache-Control: private, no-store): cache them on your side if your site gets a lot of visits. CORS is off on purpose, because the key must stay on your server.

Security

• Keep the key in your server's environment, not in browser code, mobile apps or a public repository.
• Use one key per website or service, so you can revoke one without touching the others.
• If a key may have leaked, revoke it on the Connections page and create a new one.