APIs & SDKs
Two surfaces, two jobs
| Surface | Use it to | Docs |
|---|---|---|
| Studio API | Manage things: agents, knowledge bases, skills, tools, connections, roles, audit, traces. | Studio APIs |
| Sandbox / runtime API | Run things: start a turn, stream the answer, answer an input request, cancel. | Sandbox SDK |
Loading diagram...
Interactive reference
A live, browsable OpenAPI reference is served by every Studio deployment:
GET {STUDIO_URL}/api/rpc/api-reference
GET {STUDIO_URL}/api/rpc/api-reference/spec.jsonIt is generated from the same schemas the server validates against, so it is never out of date.
Authentication at a glance
| Caller | Credential |
|---|---|
| Browser / first-party app | Session cookie from sign-in |
| Server-to-server | Studio API key (studio_...), scoped to one organization |
Every call is checked twice: your role decides what you may create, and a per-object permission decides what you may reach.
Rules that apply everywhere
- IDs are UUID v7. Time-ordered, so they also sort chronologically.
- Lists are cursor-paginated. Pass the last id as
cursor;limitis 1 to 100 (default 50). - Nothing is hard-deleted. Deletes are soft; the object disappears from reads.
- Secrets never come back. API keys, OAuth tokens and vault contents are write-only.
- Sensitive calls are audited, including the ones that are refused.
In this section
- Studio APIs: the management surface, module by module.
- Sandbox SDK: the runtime surface for embedding agents.