159 endpoints across 35 resources
Alumia API
Every surface in Alumia is backed by an HTTP API. Agents and scripts call the same real routes the app does — authenticate with an API key, scope it to exactly what the work needs, and go.
Authentication
Present your key as a bearer token on every request. Keys are minted in Settings → API keys and shown exactly once.
curl https://<your-host>/api/agents \
-H "Authorization: Bearer alk_<prefix>_<secret>"Anonymous requests to any route below get a 401. A human session cookie works too when calling from the browser.
Scopes
A key carries scopes shaped resource:action. A :write scope implies its :read. A key created without a scope list gets a least-privilege default set; only the *, admin, or full scopes grant blanket access (older keys recorded with no scopes at all stay unrestricted for compatibility). That default set withholds orgs:write, referral:write and the blanket scopes, so a default key gets a 403 on the routes below that need them — add the scope under “Additional access” when you create the key in Settings → API keys, or name the scopes you want in the scopes list on the create request. Scopes are fixed when the key is minted. A few management routes (like minting keys, approving runs, or pushing code) are human-only — no API key can call them.