Control-plane API: organizations, agents, resources (skills, memories, MCP servers, credentials), communication (channels, inbox, approvals), scheduled tasks, audit, and billing.

Authentication

Integrations authenticate with a service token on every request:

Authorization: Bearer kjtk_live_…

Create the token in the dashboard (Settings → Service tokens). It belongs to one organization and has its own permissions (scopes). The complete secret is shown only once when it is created—store it in a secret manager. You can revoke it at any time from the same dashboard.

Routes and organizations

All routes use the /v1 prefix. An organization's resources live below /v1/org/{org_id}/…: the token can see only its organization; requesting another one returns 404 without revealing whether it exists.

Each endpoint states the permission it requires (resource.action, for example agent.view). A token without that scope receives 403.

Errors

Error responses share the same shape:

{ "status": 403, "code": "PERMISSION_DENIED", "message": "…" }

code is stable and is what your code should branch on; message is supporting text. Validation errors add an errors list with details for each field.

Rate limits

There are 60-second windows per IP: 600 requests across any route as the general ceiling, with stricter quotas on sensitive surfaces (authentication 10/min, public webhooks 120/min, support 20/min). Once a limit is exceeded, the API responds with 429 and the Retry-After header.

More help

Platform guides and concepts: docs.kujira.so.