The public API powers the widget and all SDKs. It is client-key authenticated and CORS-enabled.

Base URL

All public endpoints are under /api/v1/public. Open protocols (/mcp/projects/:projectId, /a2a/projects/:projectId) are root-level.

Endpoints

Conventions

  • JSON everywhere; chat responses stream Server-Sent Events.
  • Restricted documents are always excluded from public-API retrieval.
  • group_ids — chat, search, form-deflect, and WebSocket requests accept an optional group_ids array to scope retrieval to source groups. The server intersects it with the client key’s allowed_groups: requests can narrow but never widen. Group IDs must belong to the project and the key’s allowed set, otherwise the request fails with 403.

Errors

Standard envelope with an appropriate HTTP status:
Rate limits return 429 with a Retry-After header.

Local development

Every endpoint is available on a locally-run API server at http://localhost:8280 (WebSocket: ws://localhost:8280). All SDKs accept a baseUrl override.