This page applies to Aikeedo 5.x. Class names, paths and signatures match the 5.0 source code.
Every installation serves its own interactive reference, generated from the OpenAPI specification that ships with that version:
- User API:
https://your-domain.com/app/api-docs - Admin API:
https://your-domain.com/admin/api-docs
Enable the APIs
Both APIs are disabled by default. An administrator enables each one separately.1
Open the API settings
In the admin panel, go to Settings → Features → REST API.
2
Turn on the APIs you need
Toggle User API, Admin API, or both, then select Save changes. The change takes effect on the next request.
401 Unauthorized.
Authentication
Send an API key in theX-Api-Key header with every request.
Get an API key
Each user manages their own key in the app under Settings → API keys (/app/settings/api-keys). There they can generate a key, regenerate it, or revoke it. A key belongs to a user, not to a workspace.
- User API: any active user’s key works while the User API is enabled.
- Admin API: the key must belong to a user with the
adminrole, and the Admin API must be enabled.
How requests are authenticated
Presentation\Middlewares\UserMiddleware resolves the caller for every request, in this order:
Authorization: Bearer <jwt>: the session token the Aikeedo web app uses.- The
usersession cookie, used only outside/api/and/admin/api/. X-Api-Key: replaces the user above on/api/*when the User API is enabled, and on/admin/api/*when the Admin API is enabled.
AuthorizationMiddleware then rejects requests without an active user. On /admin paths it also rejects users who aren’t administrators.
If the installation enforces strict email verification, a user with an unverified email address gets
403 Forbidden on /api endpoints until they verify it.Select a workspace
User API requests run in the context of a workspace. Credits, plan limits, library items and members all belong to it. By default Aikeedo uses the user’s current workspace, which is the one last selected in the app. To target a different workspace, send its ID in theX-Workspace-Id header:
Requests and responses
- Send JSON bodies with
Content-Type: application/json. Endpoints that accept files takemultipart/form-data. - IDs are UUID strings.
- Timestamps in responses are Unix timestamps in seconds.
- Money amounts are integers in the currency’s minor units; for example,
1999means 19.99 USD.
Pagination
List endpoints return a list object:
To fetch the next page, pass the
id of the last item on the current page as starting_after. An unknown cursor ID returns a 400 validation error whose param is the cursor parameter’s name. Most list endpoints also have a matching /count endpoint that accepts the same filters.
Errors
Aikeedo uses conventional HTTP status codes.Presentation\Middlewares\ExceptionMiddleware converts exceptions into JSON error bodies:
For
500 errors, the id is a correlation ID. The same ID appears in the server’s error log (var/log/error-*.log), so an administrator can find the full stack trace.
With
DEBUG enabled, unhandled exceptions aren’t converted to a 500 response. Never enable debug mode in production.Streaming chat responses
Chat generation streams its output as Server-Sent Events. First create a conversation, then post a message to it and read the response body as a stream.1
Create a conversation
id.2
Send a message and read the stream
POST /api/ai/conversations/{id}/messages requires model, a model key that the workspace’s plan allows. It usually includes content too. Optional fields include assistant_id, parent_id, reasoning, and uploaded files[] when you send multipart/form-data.event name, a JSON data payload and an id:
Related
Authentication internals
JWTs, cookies, API keys, roles and access control inside the core app.
Routing and middleware
How API routes, middleware stacks and error mapping are wired.
Build plugin APIs
Add your own workspace-scoped endpoints under
/api from a plugin.Streaming responses
Stream Server-Sent Events from your own plugin endpoints.