API Reference

All endpoints are relative to the API's base URL, under a /v1 prefix (see Versioning). All authenticated endpoints use an httpOnly session cookie set by POST /v1/auth/login — there is no separate API-key auth today (see Authentication).

auth

Method	Path	Auth	Notes
POST	/v1/auth/register	—	{ email, password }. Password must be 12–128 characters.
POST	/v1/auth/login	—	{ email, password }. Sets the session cookie. Rate-limited by IP and by email independently.
POST	/v1/auth/logout	session	Clears the session cookie.
GET	/v1/auth/me	session	Returns the current user.
GET	/v1/auth/google	—	Redirects to Google OAuth.
GET	/v1/auth/google/callback	—	OAuth callback; redirects into the app on success.
GET	/v1/auth/facebook	—	Redirects to Facebook OAuth.
GET	/v1/auth/facebook/callback	—	OAuth callback; redirects into the app on success.
POST	/v1/auth/forgot-password	—	{ email }. Always returns the same message, regardless of whether the email is registered.
POST	/v1/auth/reset-password	—	{ token, password }. Token is single-use and expires.

chat

Method	Path	Auth	Notes
POST	/v1/chat	session	{ model, messages, conversationId?, idempotencyKey }. Streams a plain-text response body; the response's x-conversation-id header carries the conversation id. idempotencyKey is required — a retried request with the same key never re-bills or re-calls the provider.

skills

Method	Path	Auth	Notes
POST	/v1/skills	session	{ name, instruction, input_schema?, output_schema? }. Creates a Skill private to your account.
GET	/v1/skills	session	List your own Skills.
GET	/v1/skills/templates	session	List starter templates you can duplicate into your own Skill.
POST	/v1/skills/templates/:id/duplicate	session	Copies a template into a new Skill of your own.
POST	/v1/skills/import	session	{ name, instruction, input_schema?, output_schema?, version? } — the exact shape GET /v1/skills/:id/export produces, so export → import round-trips. Any other field (id, owner_id, organization_id, allowed_tools) is rejected outright; an imported Skill never carries over a tool binding from the file.
GET	/v1/skills/:id	session	A Skill you own, with all its versions.
GET	/v1/skills/:id/export	session	The portable { name, instruction, input_schema, output_schema, version } shape, matching the import endpoint's input.
POST	/v1/skills/:id/versions	session	{ instruction, input_schema?, output_schema? }. Publishes a new immutable version.
POST	/v1/skills/:id/run	session	{ model, input, conversationId?, idempotencyKey }. Re-enters the same chat pipeline as POST /v1/chat, with input standing in for the one user message — same idempotency/quota/ledger behavior.

conversations

Method	Path	Auth	Notes
GET	/v1/conversations	session	List your own conversations.
GET	/v1/conversations/:id	session	A single conversation with its messages. 404s for a conversation you don't own.

files

Method	Path	Auth	Notes
GET	/v1/files	session	List your own uploaded files.
POST	/v1/files	session	Multipart upload, field name file. Accepts plain text, Markdown, PDF, and .docx, up to 20 MB.
DELETE	/v1/files/:id	session	Deletes a file you own (storage object + record).

plans

Method	Path	Auth	Notes
GET	/v1/plans	— (public)	Lists plans with pricing and allowed models — intentionally public so pricing is visible before sign-in.

billing

Method	Path	Auth	Notes
POST	/v1/billing/checkout	session	{ planId, provider: "sepay" | "paddle" }. The charged amount always comes from the server-side plan lookup, never the client. Free and Enterprise plans can't be checked out this way.
GET	/v1/billing/quota	session	Your current daily quota limit and remaining balance.

Two more resources exist in the running API but aren't documented as a customer-facing surface here: /v1/webhooks/* (inbound-only, called by SePay/Paddle — not something you call) and /v1/admin/* (internal, admin-only).