Skip to main content
Aikeedo includes two JSON REST APIs. Use them to connect your own applications, automations and back-office tools to an Aikeedo installation.
This page applies to Aikeedo 5.x. Class names, paths and signatures match the 5.0 source code.
Every installation serves its own interactive reference, generated from the OpenAPI specification that ships with that version:
  • User API: https://your-domain.com/app/api-docs
  • Admin API: https://your-domain.com/admin/api-docs
To browse the reference without an installation, see the User API demo docs and the Admin API demo docs.
The demo links are for reference only. Always send requests to your own installation.

Enable the APIs

Both APIs are disabled by default. An administrator enables each one separately.
1

Open the API settings

In the admin panel, go to Settings → Features → REST API.
2

Turn on the APIs you need

Toggle User API, Admin API, or both, then select Save changes. The change takes effect on the next request.
If an API is disabled, API keys are ignored for that base path and requests fail with 401 Unauthorized.

Authentication

Send an API key in the X-Api-Key header with every request.

Get an API key

Each user manages their own key in the app under Settings → API keys (/app/settings/api-keys). There they can generate a key, regenerate it, or revoke it. A key belongs to a user, not to a workspace.
  • User API: any active user’s key works while the User API is enabled.
  • Admin API: the key must belong to a user with the admin role, and the Admin API must be enabled.
An API key has the same permissions as its owner. Store keys in a secret manager or an environment variable, never in client-side code, and revoke a key right away if it leaks.

How requests are authenticated

Presentation\Middlewares\UserMiddleware resolves the caller for every request, in this order:
  1. Authorization: Bearer <jwt>: the session token the Aikeedo web app uses.
  2. The user session cookie, used only outside /api/ and /admin/api/.
  3. X-Api-Key: replaces the user above on /api/* when the User API is enabled, and on /admin/api/* when the Admin API is enabled.
AuthorizationMiddleware then rejects requests without an active user. On /admin paths it also rejects users who aren’t administrators.
If the installation enforces strict email verification, a user with an unverified email address gets 403 Forbidden on /api endpoints until they verify it.

Select a workspace

User API requests run in the context of a workspace. Credits, plan limits, library items and members all belong to it. By default Aikeedo uses the user’s current workspace, which is the one last selected in the app. To target a different workspace, send its ID in the X-Workspace-Id header:
The header applies only if the user is a member of that workspace. If the ID is unknown or the user isn’t a member, the request doesn’t get a workspace context, and endpoints that need one respond with an error. They don’t silently fall back to another workspace.

Requests and responses

  • Send JSON bodies with Content-Type: application/json. Endpoints that accept files take multipart/form-data.
  • IDs are UUID strings.
  • Timestamps in responses are Unix timestamps in seconds.
  • Money amounts are integers in the currency’s minor units; for example, 1999 means 19.99 USD.

Pagination

List endpoints return a list object:
Paginate with cursor parameters in the query string: To fetch the next page, pass the id of the last item on the current page as starting_after. An unknown cursor ID returns a 400 validation error whose param is the cursor parameter’s name. Most list endpoints also have a matching /count endpoint that accepts the same filters.
Supported filters and sort fields vary by endpoint. Check each endpoint in your installation’s interactive API reference.

Errors

Aikeedo uses conventional HTTP status codes. Presentation\Middlewares\ExceptionMiddleware converts exceptions into JSON error bodies: For 500 errors, the id is a correlation ID. The same ID appears in the server’s error log (var/log/error-*.log), so an administrator can find the full stack trace.
With DEBUG enabled, unhandled exceptions aren’t converted to a 500 response. Never enable debug mode in production.

Streaming chat responses

Chat generation streams its output as Server-Sent Events. First create a conversation, then post a message to it and read the response body as a stream.
1

Create a conversation

The response contains the conversation id.
2

Send a message and read the stream

POST /api/ai/conversations/{id}/messages requires model, a model key that the workspace’s plan allows. It usually includes content too. Optional fields include assistant_id, parent_id, reasoning, and uploaded files[] when you send multipart/form-data.
Each event has an event name, a JSON data payload and an id:
Reverse proxies can buffer streamed responses. Aikeedo sends X-Accel-Buffering: no for nginx. If your proxy or CDN buffers the response anyway, turn off response buffering for /api/ai/conversations/*/messages.

Authentication internals

JWTs, cookies, API keys, roles and access control inside the core app.

Routing and middleware

How API routes, middleware stacks and error mapping are wired.

Build plugin APIs

Add your own workspace-scoped endpoints under /api from a plugin.

Streaming responses

Stream Server-Sent Events from your own plugin endpoints.