Evaluate all flags
Evaluates every flag in the credential's environment for the evaluation context in the request body. If one flag fails to evaluate, its result has an errorCode instead of a value, and the request still succeeds.
Accepts an evaluation key, a management key, or a public token.
Returns 400 with PARSE_ERROR if the request body is not valid JSON, and 400 with INVALID_CONTEXT if it is JSON but not a valid evaluation request.
bearerAuthorizationBearer <token>Send a credential in the Authorization header: Authorization: Bearer <token>.
Each credential belongs to one environment of one workspace, so the API never takes a workspace or environment in the URL.
- Management key (
ffk_…, secret): manages flags, segments, environments, and API keys, and reads the audit log and analytics. It can also do everything an evaluation key can. - Evaluation key (
ffk_…, secret): for server SDKs. It evaluates flags, reads flag definitions for local evaluation, and sends telemetry. - Public token (
ffp_…, not secret): for browser and mobile apps. It evaluates flags through OFREP and sends telemetry. It cannot read flag definitions.
Keep secret keys on your server. A 401 response means the credential is missing or not valid. A 403 response means the credential is valid but its role cannot perform the operation.
application/json- body
The evaluation context to evaluate flags for. An empty body evaluates with an empty context.
context?Attributes of the subject you evaluate flags for. targetingKey identifies the subject, such as a user ID, and percentage rollouts use it by default. Add any other attributes your targeting rules test, such as email or plan.
OK
application/json- response
The results of evaluating every flag in the environment.
flags*array<|>One result for each flag in the environment. A result is either a success or a failure.
metadata?Free-form key-value data for the flag. Values must be strings, numbers, or booleans. Evaluation responses return it as flag metadata.
curl -X POST 'https://api.toggld.io/ofrep/v1/evaluate/flags' \ -H 'Content-Type: application/json' \ -d '{ "context": { "targetingKey": "user-123", "plan": "beta" }}'{ "flags": [ { "key": "new-checkout", "value": true, "reason": "SPLIT", "variant": "on" }, { "key": "pricing-page", "value": "control", "reason": "STATIC", "variant": "control" }, { "key": "gradual-rollout", "errorCode": "TARGETING_KEY_MISSING", "errorDetails": "Flag 'gradual-rollout' rule 'rollout' requires a bucketing key but none was provided" } ]}Evaluate a flag POST
Evaluates one flag for the evaluation context in the request body. Returns the value, the variant, and the reason it was served. Accepts an evaluation key, a management key, or a public token. Returns `404` with `FLAG_NOT_FOUND` if the flag does not exist in the credential's environment. Returns `400` if evaluation fails, such as `TARGETING_KEY_MISSING` when a percentage rollout needs a `targetingKey`. A request body that is not valid JSON returns `400` with `PARSE_ERROR`, and a JSON body that is not a valid evaluation request returns `400` with `INVALID_CONTEXT`.
Retrieve a flag snapshot GET
Returns every flag in the credential's environment with its targeting rules, and the segments those rules use. SDKs that evaluate locally poll this endpoint. Compare `version` with the version you have to tell whether anything changed. Accepts an evaluation key or a management key. Public tokens get `403`, because targeting rules must not reach browsers.