> ## Documentation Index
> Fetch the complete documentation index at: https://docs.atako.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# REST API

> Base URL, authentication, rate limits, errors, and pagination for the Atako REST API.

Atako exposes a REST API at `https://api.atako.ai` covering agents, their files,
integrations, billing, and your company/team — everything the web app itself does,
callable from scripts, CI, or your own backend. The full, browsable reference is the
[API reference](/api-reference/openapi.json) section, generated from the same
[OpenAPI 3.1](https://spec.openapis.org/oas/v3.1.0) document the API itself serves at
[`GET /openapi.json`](https://api.atako.ai/openapi.json).

<Note>
  Prefer talking to an AI client instead of writing HTTP calls by hand? See the
  [Atako MCP server](/developers/mcp/overview) — same auth, same data, no code.
</Note>

## Base URL

```
https://api.atako.ai
```

## Authentication

Every non-public endpoint takes a Bearer token — either:

* a **programmatic API key** (`aik_…`) — see [API keys](/developers/api-keys) for how
  to create one, or
* a Supabase session JWT, which is what the web app itself sends (not practical to
  obtain outside a browser session).

```bash theme={null}
curl https://api.atako.ai/agents \
  -H "Authorization: Bearer aik_..."
```

An API key acts as its owning user with all of that user's permissions — there is no
separate key scope in this release. Some endpoints additionally require you to be a
**company admin** (billing, team management, inviting members); the reference notes
this per operation.

A handful of routes are public and need no token at all — pricing, published blog/news
articles, use cases, integration marketing pages, and the OpenAPI document itself.

## Rate limits

| Plane                                                                                            | Limit                            |
| ------------------------------------------------------------------------------------------------ | -------------------------------- |
| Authenticated routes (most of the API)                                                           | 6000 requests / minute, per user |
| Public `GET` routes                                                                              | 60 requests / minute, per IP     |
| A few sensitive public `POST` routes (newsletter signup, email-exists check, invitation preview) | 10 requests / 15 minutes, per IP |

Exceeding a limit returns `429` with the standard `error`/`code` envelope below.

## Errors

Errors use a small JSON envelope:

```json theme={null}
{ "error": "AGENT_LIMIT_REACHED" }
```

`error` is either a short human-readable message or a `SCREAMING_SNAKE_CASE` code,
depending on the route — treat it as an opaque string to match against rather than a
single stable enum across the whole API. Some routes add extra fields alongside
`error` (for example `LAST_ADMIN_OF_COMPANY` also returns `companyName` and
`agentCount`) — see each operation's error responses in the reference.

Common status codes:

| Status | Meaning                                                                                                                                      |
| ------ | -------------------------------------------------------------------------------------------------------------------------------------------- |
| `400`  | Invalid request body/params                                                                                                                  |
| `401`  | Missing, malformed, or invalid bearer token                                                                                                  |
| `402`  | No active subscription / payment required                                                                                                    |
| `403`  | Authenticated, but not permitted (e.g. not a company admin)                                                                                  |
| `404`  | Not found — also returned instead of `403` on several resource-scoped routes, so a caller can't distinguish "doesn't exist" from "not yours" |
| `409`  | Conflict with current state (e.g. agent already ended)                                                                                       |
| `429`  | Rate limit exceeded                                                                                                                          |

## Pagination

List endpoints use one of two conventions, and neither returns a total count today —
fetch pages until one comes back shorter than the limit you asked for:

* **`limit`/`offset`** — most list endpoints (agents, marketing content). A plain JSON
  array response.
* **`page`/`limit`** — the credit transaction ledger (`GET /subscriptions/credits/transactions`).

## What's not in this reference

A few HTTP surfaces on `api.atako.ai` are deliberately outside this customer API
reference:

* **Admin, internal, orchestrator, and webhook-delivery routes** — not part of the
  customer-facing surface (separate secret-based auth, or third-party webhook
  ingestion).
* **The Content API** (`cak_…` keys, `/content/*`) — a separate, more restricted key
  type for headless CMS-style access to blog/news/use-case content.
* **The Atako MCP server** (`/mcp`) — see its [own docs](/developers/mcp/overview).