HTTP API for the content platform. Discovery endpoints are public; state-changing endpoints require a valid session and are same-origin protected. This reference is generated from the live OpenAPI document, available at /openapi.json. Version 1.0.0.
Public infrastructure endpoints (health/liveness probes).
/api/healthLiveness and readiness probe
Returns process uptime, server time, and presence-only environment readiness booleans (never any secret values). Always returns 200 when reachable. Not cached.
Authentication: None. Public endpoint.
200Service is reachable.Public, unauthenticated metadata endpoints for crawlers and integrations.
/llms.txtMachine-readable product description
Returns the llms.txt product overview (capabilities, data handling, plans, discovery links) as plain text for AI crawlers. Cacheable.
Authentication: None. Public endpoint.
200Plain-text product description./agents.jsonAgent preset catalog
Returns the agent preset catalog (preset and agent shape: id, name, expertise, tier, dependencies). Discovery metadata only; internal prompt text is not disclosed. Cacheable.
Authentication: None. Public endpoint.
200Agent preset catalog./openapi.jsonThis OpenAPI document
Returns this OpenAPI 3.1 document describing the platform API. Cacheable.
Authentication: None. Public endpoint.
200OpenAPI 3.1 document.Session-authenticated usage recording.
/api/usageRecord a batch of usage events
Persists a counts-only metering batch for the authenticated caller, stamped with the server-resolved tenant and user. The request schema is strict (counts only; no free-text content). This endpoint runs after a run completes and is fail-safe: it never blocks a run.
Authentication: Session cookie required (same-origin enforced for state-changing requests).
| Field | Type | Required | Description |
|---|---|---|---|
| surface | enum: chat | studio | api | eval | unknown | Required | Originating product surface. |
| events | array of object | Required | One to 500 usage events. |
200Batch accepted. Returns recorded versus received counts.400Invalid JSON body.401No valid session.403Caller has no active tenant membership, or request failed the same-origin check.422Body failed schema validation.429Rate limit exceeded (per-user or per-tenant). Includes a Retry-After header.Session-authenticated document ingestion.
/api/ingestIngest a reference document
Accepts a reference document for the authenticated caller in one of two modes: a multipart file upload (DOCX, TXT, or MD; parsed in-process) or a JSON body containing an already client-parsed document (PDF text). Each successful ingest is written to the append-only audit log. Returns the canonical parsed document.
Authentication: Session cookie required (same-origin enforced for state-changing requests).
| Field | Type | Required | Description |
|---|---|---|---|
| parsed | object | Required | Canonical parsed-document contract. No PHI in the default configuration. |
| filename | string | Optional | Optional original filename for the audit record. |
| Field | Type | Required | Description |
|---|---|---|---|
| file | string (binary) | Required | DOCX, TXT, or MD file (max 10 MB). PDF must be posted as JSON instead. |
200Document ingested. Returns the canonical parsed document.400Invalid JSON body, missing file field, or unexpected content type.401No valid session.403Request failed the same-origin check.413Uploaded file exceeds the 10 MB limit.415Unsupported format, or a PDF was uploaded via multipart (post it as JSON instead).422Parsed-document body failed schema validation.429Rate limit exceeded (per-user or per-tenant). Includes a Retry-After header.500Internal parse contract violation.Session-authenticated, admin-gated organization data export.
/api/compliance/exportExport organization data (right of access)
Returns a JSON snapshot of the caller's organization (members, plan/usage summary, productions, audit history) as a downloadable attachment. Admin/owner only; tenant-scoped; rate-limited; the export itself is recorded in the audit log. No PHI in the default configuration. POST (not GET) because it writes one audit row.
Authentication: Session cookie required (same-origin enforced for state-changing requests).
200A JSON data export (Content-Disposition: attachment).401No valid session.403No active membership, insufficient role (admin/owner required), or failed same-origin check.429Rate limit exceeded. Includes a Retry-After header.500Export could not be generated (opaque reference returned).