---
seo:
  description: The public HTTP interface to Subako.
sidebar:
  label: Overview
title: Subako Public API
---
The public HTTP interface to Subako.

Every request carries a bearer credential, and the organization it acts in is the credential's -- no path names one. Work resources belong to a workspace, named by the `Kikuvi-Workspace` header where a user credential cannot imply one.

Listings are cursor paged: pass the `next_cursor` a page returns back as `after`, and `order` decides which way the walk continues. Writes that create something accept an `Idempotency-Key`, and a retry under the same key returns the saved receipt rather than acting twice.

<ApiOverview source="api" />

## agents

The named lines a session runs, and the immutable versions that carry their config.

<ApiTagOperations source="api" tag="agents" />

## api-keys

Long-lived credentials for a backend, scoped to one workspace and the permissions they were minted with.

<ApiTagOperations source="api" tag="api-keys" />

## me

Who the presented credential belongs to.

<ApiTagOperations source="api" tag="me" />

## model-providers

Where model calls are sent: a platform provider Subako publishes, or one bound to your own key.

<ApiTagOperations source="api" tag="model-providers" />

## organization

The tenant a credential acts in: its members, its invitations, and what it has spent.

<ApiTagOperations source="api" tag="organization" />

## sessions

One agent version running against one event log: its input, its transcript, its sandboxes, and its tokens.

<ApiTagOperations source="api" tag="sessions" />

## clients

A client offers tools of its own to a session's agent, and answers the calls the model makes to them.

<ApiTagOperations source="api" tag="clients" />

## skills

Versioned bundles an agent may be granted.

<ApiTagOperations source="api" tag="skills" />

## vaults

Credentials an agent presents to the services it reaches. A payload goes in and never comes back out.

<ApiTagOperations source="api" tag="vaults" />

## workspaces

The scope every work resource belongs to, and who may reach it.

<ApiTagOperations source="api" tag="workspaces" />