Skip to main content
Atako exposes a REST API at https://api.atako.ai covering agents, their files, integrations, billing, and your company/team — everything the web app itself does, callable from scripts, CI, or your own backend. The full, browsable reference is the API reference section, generated from the same OpenAPI 3.1 document the API itself serves at GET /openapi.json.
Prefer talking to an AI client instead of writing HTTP calls by hand? See the Atako MCP server — same auth, same data, no code.

​
Base URL

​
Authentication

Every non-public endpoint takes a Bearer token — either:
  • a programmatic API key (aik_…) — see API keys for how to create one, or
  • a Supabase session JWT, which is what the web app itself sends (not practical to obtain outside a browser session).
An API key acts as its owning user with all of that user’s permissions — there is no separate key scope in this release. Some endpoints additionally require you to be a company admin (billing, team management, inviting members); the reference notes this per operation. A handful of routes are public and need no token at all — pricing, published blog/news articles, use cases, integration marketing pages, and the OpenAPI document itself.

​
Rate limits

Exceeding a limit returns 429 with the standard error/code envelope below.

​
Errors

Errors use a small JSON envelope:
error is either a short human-readable message or a SCREAMING_SNAKE_CASE code, depending on the route — treat it as an opaque string to match against rather than a single stable enum across the whole API. Some routes add extra fields alongside error (for example LAST_ADMIN_OF_COMPANY also returns companyName and agentCount) — see each operation’s error responses in the reference. Common status codes:

​
Pagination

List endpoints use one of two conventions, and neither returns a total count today — fetch pages until one comes back shorter than the limit you asked for:
  • limit/offset — most list endpoints (agents, marketing content). A plain JSON array response.
  • page/limit — the credit transaction ledger (GET /subscriptions/credits/transactions).

​
What’s not in this reference

A few HTTP surfaces on api.atako.ai are deliberately outside this customer API reference:
  • Admin, internal, orchestrator, and webhook-delivery routes — not part of the customer-facing surface (separate secret-based auth, or third-party webhook ingestion).
  • The Content API (cak_… keys, /content/*) — a separate, more restricted key type for headless CMS-style access to blog/news/use-case content.
  • The Atako MCP server (/mcp) — see its own docs.