The reference in this section is generated from the control plane's OpenAPI schema — each endpoint has a live request builder and real response shapes. This page covers the conventions that apply across all of them.
Base URL
https://api.identark.io
http://localhost:8000
All application endpoints are versioned under /v1. GET /health (unversioned) is a
liveness probe.
Authentication
Send a scoped csk_ key as a bearer token on every request:
Authorization: Bearer csk_…
The required scope is listed on each endpoint. org:admin covers all of them. See
Authentication & scopes for the full model. A handful of
endpoints are public: POST /v1/orgs/signup, POST /v1/auth/signup,
POST /v1/auth/login, GET /v1/config/public, and GET /health.
Conventions
Content type
Request and response bodies are JSON. Send `Content-Type: application/json`.Timestamps
ISO 8601 strings, UTC (e.g. `2026-08-13T09:00:00Z`).IDs
Opaque strings. Don't parse them; store and echo them back.Errors
JSON with a stable `error_code` and human `message`. See Limits & errors.The endpoints you'll use most
POST /v1/keys
Mint a scoped API key.POST /v1/credentials
Store a provider secret, get a `credential_ref`.POST /v1/sessions
Open a bounded, cost-capped session.POST /v1/llm/invoke
Run a governed completion.Browse the full surface in the Endpoints group in the sidebar.