Until yesterday, UluP Spaces was a product you use. As of tonight, it's also a product you can *build on*.
From App to Platform
I opened up a public REST API (`/api/v1/*`) that exposes projects, nodes, connections, and tasks — the exact same functions I use on the MCP side to let Claude work inside Spaces, now available to anyone who wants to write their own tool on top of it. Docs, a quickstart, and the full endpoint reference are up at ulupstudio.com/developers.
Rate Limiting and Webhooks
A public API needs two things a private one can afford to skip: protection from abuse, and a way to get notified when something happens. I added a sliding-window rate limiter (100 requests per minute per key, with `X-RateLimit-*` headers so you can keep your own count) and webhooks: register a URL, and get a signed (HMAC) notification whenever a project, node, or task is created, or a task gets completed — no need to poll the API in a loop to find out something changed.
The Plugin Directory
And then the fun part: a public directory (ulupspaces.com/plugins, mirrored on ulupstudio.com/plugins) where anyone building something on top of this API can submit it to the community. Same principle already used for templates — submit, manual review, publish — just applied to code instead of maps this time. I also built myself a small review panel so I don't have to open Supabase by hand every time a submission comes in.
The First Plugin: Quick Capture
An empty directory convinces no one, so I built the first plugin the same night: #F2F1F5] font-semibold">Quick Capture, a Chrome extension that saves any web page as a node in a UluP Spaces project, in one click — the page's link also gets added as a task inside the node, if you want. Source is open [on GitHub, MIT licensed.
Building it also surfaced something I hadn't planned for: a redirect between `ulupspaces.com` and `www.ulupspaces.com` that, once the browser followed it, silently dropped the authentication header along the way. It's the kind of bug no manual curl test would ever catch, but any real client would run straight into. Fixed now — and a good reminder for the future: if you're building on this API, always point at the exact domain.
Why It Matters
This isn't just "one more API." It's the difference between a product you grow alone and an ecosystem others can grow with you. UluP Spaces becomes v4.0 tonight not because of how many features got added, but because, for the first time, someone else can build something on it that I haven't even imagined yet.
The first plugin is already there, in the directory. The next one, maybe, is yours to write.