Apify
Fronts run-sync execution for Apify actors and tasks on https://api.apify.com: trigger a saved task or an actor and receive its output — or its dataset items — in the same response. Whatever follows /apify/ is relayed to Apify, provided it names one of the run-sync actions:
Admission is default-deny against a fixed allowlist: only the run-sync actions listed below get through, and every other path draws a 404 until the endpoint concerned is added to the allowlist. Mounted methods: POST.
Common paths
Give {actorId} / {actorTaskId} in tilde form as one path segment (e.g. apify~web-scraper); the slash-separated username/name form is not accepted.
Credential handling
Apify will take its token through two channels — a token query parameter or an Authorization: Bearer header — and the gateway closes off both:
Authorizationis overwritten with Apify’s secret token (Apify reads the very header that carries your gateway token). The gateway consumes your token itself; Apify never receives it.- A
tokensupplied by the client in the query is discarded (any encoding), so nothing can displace the injected token.
Examples
Run an actor (sync)
Run a saved task (sync)
Responses arrive as Apify’s JSON, untouched. Field-level request and response detail lives in Apify’s API reference; the gateway modifies neither.