> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.cloudraker.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.cloudraker.com/_mcp/server.

# API reference

## Base URL

Every call goes to the one gateway base:

```
https://api.cloudraker.com
```

The API returns opaque string ids. See [Versioning and compatibility](/paperwork/developers/versioning) for what can change without warning.

## Authentication

Every request carries a bearer token in the `Authorization` header. The developer credential is an **organization API key**. Create the key in the app under **Admin > API keys**. See the [API keys guide](/workspace/admin/api-keys).

### Request

GET [https://api.cloudraker.com/me](https://api.cloudraker.com/me)

```curl
curl https://api.cloudraker.com/me \
     -H "Authorization: Bearer <token>"
```

```typescript
import { CloudRakerClient } from "@cloudraker/api";

async function main() {
    const client = new CloudRakerClient({
        token: "YOUR_TOKEN_HERE",
    });
    await client.me.getMe();
}
main();

```

```python
from cloudraker import CloudRaker

client = CloudRaker(
    token="YOUR_TOKEN_HERE",
)

client.me.get_me()

```

```go
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.cloudraker.com/me"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby
require 'uri'
require 'net/http'

url = URI("https://api.cloudraker.com/me")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body
```

```java
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.get("https://api.cloudraker.com/me")
  .header("Authorization", "Bearer <token>")
  .asString();
```

```php
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://api.cloudraker.com/me', [
  'headers' => [
    'Authorization' => 'Bearer <token>',
  ],
]);

echo $response->getBody();
```

```csharp
using RestSharp;

var client = new RestClient("https://api.cloudraker.com/me");
var request = new RestRequest(Method.GET);
request.AddHeader("Authorization", "Bearer <token>");
IRestResponse response = client.Execute(request);
```

```swift
import Foundation

let headers = ["Authorization": "Bearer <token>"]

let request = NSMutableURLRequest(url: NSURL(string: "https://api.cloudraker.com/me")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "GET"
request.allHTTPHeaderFields = headers

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```

An API key is an org-level machine credential. It resolves to your organization and can call any org-wide or admin route. The app shows the plaintext value **once**, when you create the key. You cannot retrieve it again. Store it in a safe place. The API also accepts session JWTs from the web app, but use API keys for integrations.

API keys carry no per-user membership. A key cannot satisfy a route gated on a specific person's fine-grained resource grant. Use keys for server-to-server, org-wide automation.

### Auth responses

| Status                               | Meaning                                                   |
| ------------------------------------ | --------------------------------------------------------- |
| `401 unauthorized` / `invalid_token` | Missing, malformed, or invalid token.                     |
| `404 org not found`                  | The token's identity has no organization.                 |
| `503 auth_unavailable`               | A transient upstream outage during key validation. Retry. |

`GET /health` is the only unauthenticated endpoint you normally touch.

## Endpoint groups

#### Me & home

`GET /me`, preferences, and the `GET /home` dashboard for the current user.

#### Spaces & space-types

Spaces are the primary tenant container. Each space belongs to a space-type template. List, read, and archive spaces, and manage types.

#### Files

Space-scoped storage. Register a file to get a presigned upload URL. Upload the bytes, then poll until the file is processed.

#### Actions & runs

Install actions from the catalog, then dispatch a run in a space and fetch its result, outputs, and audit trail.

#### Playbooks & runs

Agentic multi-step runs with approvals, a live timeline, run controls, and a WebSocket ticket for streaming.

#### Objects

Org-level data-object definitions plus space-scoped objects with a 14-operand filter, sort, offset paging, and saved views.

#### Ontology

Entity/relation knowledge graph. Ingest files into namespaces and search entities across a space or the whole org.

#### Search

`GET /spaces/{spaceId}/search` runs semantic search over a space's indexed files. It returns grounded page/bbox/timecode hits.

#### Authorization

Check your own permissions, manage grants, and manage groups (teams).

#### Organization & users

Admin housekeeping: organization details, logo, templates, users, memberships, roles, and API keys.

#### Process

One-call ingestion: upload files, run actions, and receive signed webhooks in a single multipart request.

## How scoping and authorization work

* **One organization = one tenant.** Your token's org determines which data you reach. There is no cross-tenant access.
* The gateway enforces fine-grained **per-resource permissions**. Missing `space:read` returns **404**, which hides existence. Missing `space:contribute` returns **403**. Org admins bypass space checks.
* **Errors** are JSON `{ "error": "<snake_case_code>" }`. Pagination is per-group. See each endpoint for its `limit`/`offset`/cursor shape.

The [Developer guide](/paperwork/developers/overview) covers authentication, the file-upload flow, and reacting to events. Browse each endpoint in the sidebar, with parameters, schemas, and a runnable example.