API

API reference — deployed routes

The session-authenticated and public endpoints implemented today.

Availability note — these docs describe both working and planned product areas. Account authentication, administrator-managed AIHK/AICA tenant regions and keys, signed-in Composer runs and public Guard scans are connected. Skills, Memory, Agents, Workflows, Apps, billing, the public SDK/CLI and the unified API are previews unless a section explicitly says otherwise.

Authentication

Browser and administration routes use the gc_session HTTP-only cookie. Scoped workspace keys are accepted as Bearer credentials by workspace reads/writes, Guard scans and Composer runs. Key creation, listing and revocation remain session-only; Guard scanning also works without authentication.

Members must belong to an active tenant. Their workspace data and AI gateway access are tenant-scoped; unassigned and suspended members fail closed. Platform administrators have global administration access and can enter a visible, read-only Shadow tenant support view.

Endpoints

POST               /api/v1/auth/signin|signup|signout
POST               /api/v1/auth/change-password|ip-admin
GET|PATCH          /api/v1/auth/me
GET|DELETE         /api/v1/auth/sessions

GET                /api/v1/workspace
GET|PATCH          /api/v1/workspace/settings
GET                /api/v1/workspace/activity
GET|POST           /api/v1/workspace/skills
PATCH|DELETE       /api/v1/workspace/skills/{id}
GET|POST           /api/v1/workspace/memory
PATCH|DELETE       /api/v1/workspace/memory/{collectionId}
GET|POST           /api/v1/workspace/memory/{collectionId}/sources
PATCH|DELETE       /api/v1/workspace/memory/{collectionId}/sources/{sourceId}
GET|POST           /api/v1/workspace/drafts/{agents|workflows|apps}
PATCH|DELETE       /api/v1/workspace/drafts/{kind}/{id}
GET|POST           /api/v1/workspace/api-keys
DELETE             /api/v1/workspace/api-keys/{id}
GET                /api/v1/workspace/ai-access
GET                /api/v1/workspace/ai-access/guide

GET|POST           /api/v1/guard/scan
POST               /api/v1/run

GET|POST           /api/v1/admin/tenants|users
PATCH              /api/v1/admin/tenants/{id}|users/{id}
PATCH              /api/v1/admin/users/{id}/tenant
GET|POST           /api/v1/admin/tenants/{id}/ai-keys
DELETE             /api/v1/admin/tenants/{id}/ai-keys/{keyId}
POST               /api/v1/admin/ai-gateways/diagnostics

Read the workspace

terminal
curl -c gencms.cookies https://gen-cms.com/api/v1/auth/signin \
  -H "Origin: https://gen-cms.com" \
  -H "Content-Type: application/json" \
  -d '{ "email": "[email protected]", "password": "your-password" }'

curl -b gencms.cookies https://gen-cms.com/api/v1/workspace \
  -H "Origin: https://gen-cms.com"

Workspace Skill, Memory, Agent, Workflow and App routes persist records and drafts. They do not execute Skills, index Memory for retrieval, or run Agent/Workflow/App drafts.

Guard scan

request
POST /api/v1/guard/scan

{ "target": "https://github.com/acme/our-skill", "mode": "skill" }

Guard accepts pasted content or exact public github.com repositories. Arbitrary URL and MCP endpoint fetching, private repository collection, redirect following and ZIP upload are disabled.

Model execution status

POST /api/v1/run uses the active tenant’s assigned AIHK or AICA gateway and requires one ready region-locked key with chat enabled. It fails closed when that tenant access is disabled or not ready. It does not accept a caller-selected provider, and there is no GenCMS /api/v1/chat/completions, /api/v1/models or Skill-run endpoint.

← PreviousTrust levelsNext →Errors and limits