Complete API Reference
Production-ready REST API with streaming support, multi-tenant isolation, and AI-powered features. Integrate in any language.
Quick Start Guide
Get started by creating a new tenant account. You'll receive an API key and Tenant ID primarily used for authenticating subsequent requests.
1Register & Get API Key
Response Schema
{
"success": true,
"data": {
"apiKey": "sk_live_...",
"tenantId": "550e84...",
"scopes": ["tenant:read", ...]
}
}Chat API (Streaming)
The Chat API provides AI-powered conversational capabilities with real-time streaming responses, RAG (Retrieval-Augmented Generation) support, and function calling. Perfect for customer support, sales assistance, and interactive chatbots.
Initiates a chat conversation with the AI. Responses are streamed in real-time using Server-Sent Events (SSE), allowing for immediate feedback and progressive rendering of text. The API automatically retrieves relevant documents from your RAG store and can execute function calls for dynamic actions.
Request Body
| Param | Type | Req. |
|---|---|---|
| tenantId | string | Yes |
| message | string | Yes |
| accountId | string | Opt. |
| files | string[] | Opt. |
| prompt | string | Opt. |
Event Types
Chat History Management
Retrieve and manage conversation history. Access past chats for audit trails, customer support review, or conversation analytics. All endpoints enforce strict tenant isolation for security.
List Conversation History
Retrieve all conversations for a tenant. Results are automatically sorted by most recent activity. Filter by accountId to get conversations for specific customers.
Query Parameters
| Param | Type | Required |
|---|---|---|
| tenantId | string | Yes |
| accountId | string | Opt. |
Response Data
- • Sorted by
updated_atDESC (newest first) - • Includes message count per conversation
- • Returns metadata timestamps (created, updated)
Required Scope
chat:read
Delete Conversation
Permanently delete a specific conversation and all its messages. The system validates that the conversation belongs to the tenant before deletion to prevent unauthorized access.
Path Parameters
| Param | Description |
|---|---|
| chatId | Conversation UUID to delete |
Important Notes
- • Permanent deletion - Cannot be undone
- • Tenant isolation - Validates ownership before delete
- • Returns 403 if chat doesn't belong to tenant
- • Returns 404 if chat ID doesn't exist
Required Scope
chat:delete
Estimator API (Streaming)
The Estimator API analyzes images to detect items, calculate dimensions and volumes, and provide packing recommendations for moving and storage.
Upload one or more images of items to receive AI-powered analysis including item detection, size estimation, and volume calculation. Results stream in real-time.
Request Body
| Param | Type | Req. |
|---|---|---|
| images | string[] | Yes |
| tenantId | string | Yes |
Constraints
- • Max 10 images per request
- • Max 10MB per image file
- • Formats: JPEG, PNG, WebP
Files & RAG Store API
Manage your RAG (Retrieval-Augmented Generation) document store. Sync from AssetVault and configure citation settings.
Retrieve comprehensive information about your RAG store including file count, storage usage, and sync status.
Response Data
- • Storage usage & quotas
- • Active/Excluded file counts
- • Full file list with IDs
Import documents from AssetVault into the RAG store. Sync specific files by providing a list of asset IDs.
Constraints
- • Supported: PDF, TXT, DOCX
- • Async processing (~30s/file)
RAG Store - Advanced Operations
Monitor and debug RAG store operations with real-time progress tracking and comprehensive audit logs. Essential for production debugging and ensuring reliable AI document synchronization.
Real-Time Sync Progress
Get live progress updates during RAG store sync operations. Returns completion percentage, processed file count, ETA, and current file being processed. Use smart polling pattern for optimal performance.
Operation Status Values
• idle - No operation in progress
• in_progress - Currently syncing files
• completed - Sync finished successfully
• failed - Sync encountered errors
Smart Polling Pattern
- • Poll every 1.5 seconds (optimal interval)
- • Stop when status is
completed,failed, oridle - • Use exponential backoff on errors
- • Set max timeout (recommended: 5 minutes)
RAG Store Audit Logs
Get complete audit trail for RAG store operations. Essential for debugging sync failures, tracking file processing history, and compliance requirements. Filter by specific file or retrieve all tenant logs.
Query Parameters
| Param | Description |
|---|---|
| assetId | Filter logs for specific file (optional) |
| limit | Max logs to return (default: 100) |
| offset | Pagination offset (default: 0) |
Common Event Types
• sync_started - File sync initiated
• sync_completed - File successfully processed
• sync_failed - Processing error occurred
• file_excluded - File marked as excluded
• file_deleted - File removed from store
Debugging Workflow
- 1. Check file status in UI
- 2. Query audit logs for specific
assetId - 3. Look for
sync_failedevents - 4. Review
details.error_messagefor root cause
Tenants & Accounts API
Multi-tenant architecture APIs for managing organizations and user accounts.
Create a new tenant organization with isolated data storage. Each tenant gets a unique ID and independent RAG store.
Admin Required
Requires systemic admin-level API key authorization.
Create specific user accounts under a tenant. Accounts provide individual file storage boundaries and permissions.
RBAC Roles
- • admin → Full access, can create API keys
- • member → Read/write, cannot create API keys
- • viewer → Read only access
API Key Management
Create and manage API keys for your tenant. Essential for multi-environment deployments (development, staging, production) and implementing key rotation for security compliance.
List API Keys
Retrieve all API keys for a tenant. Returns metadata including scopes, creation date, and last used timestamp. The actual secret key is NEVER returned for security.
Response Fields
- •
id- Key identifier - •
name- Human-readable name - •
scopes- Array of permissions - •
last_used_at- Activity tracking - •
expires_at- Expiration (if set)
Security Notes
- • Raw API keys are NEVER returned
- • Only hashes are stored in database
- • Monitor
last_used_atfor inactive keys
Create API Key
Generate a new API key with custom name and scopes. The raw secret key is returned ONLY ONCE during creation and must be saved immediately. Lost keys cannot be recovered.
Request Body
| Field | Type | Required |
|---|---|---|
| name | string | Yes |
| scopes | string[] | Opt. |
CRITICAL WARNING
🔴 The apiKey field is shown ONLY ONCE
🔴 If lost, you MUST create a new key
🔴 Save to secure storage immediately (e.g., AWS Secrets Manager)
🔴 Never commit keys to version control
Best Practices
- • Principle of Least Privilege: Grant minimum scopes
- • Environment Separation: Separate keys for dev/staging/prod
- • Key Rotation: Rotate every 90 days
- • Monitoring: Track
last_used_atfor anomalies
Usage & Quota Tracking
Monitor API usage, track quotas, and implement proactive alerts before hitting limits. Essential for billing transparency, capacity planning, and preventing service interruptions.
Get Current Usage Statistics
Retrieve comprehensive usage metrics including requests, tokens, rate limits, and plan details. Response includes both absolute values and percentages for easy monitoring dashboards.
Usage Metrics
• Requests: Monthly API calls (used/limit/remaining)
• Tokens: AI model tokens consumed
• Rate Limits: Current minute usage (anti-abuse)
• Daily Limits: Today's request count
Response Headers
Every API response includes usage headers:
- X-Usage-Requests-Remaining
- X-Usage-Tokens-Remaining
- X-Usage-Requests-Percent
- X-Usage-Tokens-Percent
Quota Exceeded Scenarios
• Monthly Quota: Returns 429, resets on billing anchor day
• Rate Limit: Returns 429, retry after 60 seconds
• Daily Limit: Returns 429, resets at midnight UTC
Monitoring Best Practices
- • Set alerts at 80% usage threshold
- • Check usage before batch operations
- • Track
percentUsedtrends over time - • Implement graceful degradation on quota limits
Asset Manager Authentication
Manage authentication for the Asset Manager (file storage interface). Features OWASP-compliant password validation, rate limiting, and secure password generation patterns for automated onboarding flows.
Update Asset Manager Password
Set or update the password for tenant's Asset Manager account. Used during onboarding or password reset. Implements OWASP password strength validation and rate limiting to prevent brute force attacks.
Request Body
| Field | Type | Required |
|---|---|---|
| newPassword | string | Yes |
| confirmPassword | string | Yes |
OWASP Password Requirements
- • Minimum 8 characters (recommended: 16+)
- • At least one uppercase letter (A-Z)
- • At least one lowercase letter (a-z)
- • At least one number (0-9)
- • At least one special character (!@#$%^&*)
- • Maximum 128 characters
Rate Limiting
• 5 attempts per 15 minutes per tenant
• Returns 429 when exceeded
• Prevents brute force attacks
Automated Onboarding
For automated tenant provisioning:
- 1. Generate cryptographically strong password (16+ chars)
- 2. Call this endpoint to set password
- 3. Store credentials in secrets manager
- 4. Email credentials to tenant securely
Security Best Practices
- • Never log or display passwords in plain text
- • Use cryptographically secure random generation
- • Store in secrets manager (AWS Secrets, HashiCorp Vault)
- • Enforce password rotation every 90 days
- • Use HTTPS for all password transmissions
Health & Monitoring APIs
Production-ready health check endpoints for Kubernetes, load balancers, and monitoring systems. Implement proper liveness and readiness probes following cloud-native best practices.
Liveness Probe - Kubernetes Health Check
Fast, lightweight health check that verifies the service process is running. Returns service metadata including version, uptime, and memory usage. Does NOT check external dependencies.
Response Fields
- •
status- "healthy" | "degraded" | "unhealthy" - •
version- Deployment version - •
uptime- Seconds since start - •
memory- Heap usage (MB)
Kubernetes Configuration
livenessProbe:
path: /api/v1/health
initialDelaySeconds: 10
periodSeconds: 30
Readiness Probe - Dependency Health Check
Comprehensive health check that validates ALL critical dependencies including Database (Supabase), Redis, and optionally Gemini API. Load balancers use this to determine if service can accept traffic.
Dependency Checks
- • Database: Supabase query (timeout: 5s)
- • Redis: PING command (timeout: 2s)
- • Gemini API: Endpoint reachability (optional)
Status Codes
- • 200: All critical checks passed (ready)
- • 503: One or more critical checks failed (not ready)
Production Best Practices
- • Use in load balancer health checks
- • Poll before deployment rollout
- • Implement retry logic with backoff
- • Monitor
totalLatencyMsfor performance
Authentication
All API requests require authentication via the x-api-key header. Keys are managed in the dashboard under Security settings.
Security Architecture
We implement a Backend-for-Frontend (BFF) proxy. Internal keys are never exposed to the client-side network traffic.
Best Practices
- • Store keys in secure environment variables
- • Rotate production keys every 90 days
- • Use tenant-scoped keys for distribution
Error Handling
HTTP Status Codes
Success
Request completed successfully
Created
Resource created successfully
Bad Request
Invalid request body or parameters
Unauthorized
Missing or invalid API key
Forbidden
Insufficient permissions
Not Found
Resource does not exist
Rate Limit Exceeded
Too many requests
Internal Server Error
Server error - contact support
Error Response Format
{
"success": false,
"error": {
"code": "UNAUTHORIZED",
"message": "Invalid or missing API Key"
}
}Complete API Reference - 32 Endpoints
All available endpoints organized by category with required scopes
/api/v1/registerRegister organization and get API key
/api/v1/healthLiveness probe (Kubernetes)
/api/v1/readyReadiness probe with dependency checks
/api/v1/tenantsGet own tenant information
/api/v1/tenantsCreate new tenant (admin only)
/api/v1/tenants/{tenantId}Get tenant details
/api/v1/chatSend chat message (streaming SSE)
/api/v1/chat/historyGet conversation history
/api/v1/chat/history/{chatId}Delete conversation
/api/v1/estimator/analyzeAnalyze images (streaming)
/api/v1/tenants/{tenantId}/storeGet RAG store details
/api/v1/tenants/{tenantId}/store/syncSync files from AssetVault
/api/v1/tenants/{tenantId}/store/refreshRefresh document metadata
/api/v1/tenants/{tenantId}/store/files/actionsBulk file operations
/api/v1/tenants/{tenantId}/store/progressReal-time sync progress
/api/v1/tenants/{tenantId}/store/auditGet audit logs
/api/v1/tenants/{tenantId}/accountsCreate account
/api/v1/tenants/{tenantId}/accounts/{accountId}Get account details
/api/v1/tenants/{tenantId}/accounts/{accountId}Update account
/api/v1/tenants/{tenantId}/accounts/{accountId}/filesUpload file to RAG store
/api/v1/tenants/{tenantId}/accounts/{accountId}/filesList files
/api/v1/tenants/{tenantId}/accounts/{accountId}/files/{fileId}Delete file
/api/v1/tenants/{tenantId}/api-keysList API keys
/api/v1/tenants/{tenantId}/api-keysCreate API key
/api/v1/tenants/{tenantId}/asset-auth/passwordUpdate Asset Manager password
/api/v1/usageGet usage statistics and quotas
Ready to Get Started?
Get your API key and start building in minutes