API Reference
The data-plane REST API, generated from the running server's own contract.
Everything under this section is generated from the API's OpenAPI contract — paths, parameters, schemas, and the request samples. None of it is written by hand, so it cannot describe an API that no longer exists.
What is here
| Group | Contains |
|---|---|
| Auth | Sign-in, tokens, passwordless, social, linked identities |
| Agents | Invoke, runs, direct tool calls, MCP |
| Users | Your app's end users |
| Storage | Buckets, files, folders, uploads |
| Organizations | Your app's own orgs, memberships, invitations |
| Billing | Products, orders, subscriptions |
| Your data | Every table you defined — the same five operations each |
Reading a path
Paths begin with your app's id, shown as an {appUid} parameter:
GET /{appUid}/autocrud/ticketsFind your app id in the console, on the app's settings page.
What is deliberately absent
The control plane — creating apps, editing schema, writing policies — is not here. That is the console's own API, documented as how-to guides rather than as a contract, and it is not a surface your application should call.
Internal tables are absent too. An app's database contains machinery Authoric uses to run it: policy rows, handler versions, the realtime outbox. Those are reachable in principle but are not customer API, so they are withheld from this reference rather than presented as something to build against.
Authentication
Every endpoint takes a bearer token — a user's access token, or an agent api key:
Authorization: Bearer <token>Failures carry a stable error.code. See the
error-code reference.
Billing
Two separate billing relationships — yours with Authoric, and your customers' with you.
Stop a run
Stops the run, explicitly and on the record. This is the only control an api key has over its own run, by design: stopping only ever reduces what an agent does, so it cannot be used to escalate. Approving and resuming stay member-token operations.