Attensira REST API

The REST API is Attensira for your own code. Same data, same key, and the capabilities the MCP server exposes, over plain HTTP instead of MCP, so a cron job, a CI step, a dashboard or a data pipeline can reach it without speaking a protocol built for assistants.

Which door to use

The two surfaces are twins on purpose. Every REST endpoint has an MCP tool with the same payload, so a customer’s answer never depends on which door they came through. The few tools without a REST endpoint yet, the markets reads, are listed under MCP-only for now and marked MCP-only in the tool reference. A key holder can add a workspace for a new domain with POST /v1/onboarding/workspace; the person still pays in their own browser. A new person with no account yet starts in the app, or from an assistant over MCP, where signing in comes first.

Use	When
MCP server	An assistant is doing the work — Claude Code, Cursor, ChatGPT. The assistant discovers the tools and decides which to call.
REST API	Your code is doing the work — a nightly export, a deploy check, an internal dashboard, a Zapier or n8n HTTP step.

Both take the same atn_live_ key, so you do not need a second credential to add the other. The REST API takes a key only; OAuth connections belong to the MCP server.

Base URL

https://api.attensira.com

Every endpoint lives under /v1. https://api.attensira.com/healthz is unauthenticated and answers without a key, which makes it a useful reachability check when a client is silent about why it failed.

Your first request

Shell

curl https://api.attensira.com/v1/account \
  -H "Authorization: Bearer atn_live_<your key>"

Response

{
  "org": { "id": "org_3a10" },
  "project": { "id": "prj_5b22", "name": "Acme", "domain": "acme.com" },
  "workspaces": [{ "id": "prj_5b22", "name": "Acme", "domain": "acme.com" }],
  "credits": { "available": 4200, "available_usd": 42.0, "held_units": 0 },
  "scopes": ["read", "write"],
  "platforms": ["chatgpt", "perplexity"]
}

Call /v1/account first from a fresh integration: it lists every workspace the credential can reach, confirms which one it resolved to, and its platforms array is the authority on which AI answer surfaces were queried at all. A platform missing from that list was never measured — which is not the same as measured at zero.

What the API can do

A key can delete prompts, competitors, automations and sessions, and spend credits. Treat it as a workspace credential, not a read token. The endpoints that spend credits are POST /v1/prompts, POST /v1/automations/{id}/runs and POST /v1/ask, plus POST /v1/sessions/{id}/context with run: true, POST /v1/inbox/tasks/{id}/answer when the run that asked had already finished, and the run that answers a POST /v1/work-areas/{id}/steer. The ones that destroy data are DELETE /v1/prompts/{prompt}, DELETE /v1/competitors/{id}, DELETE /v1/automations/{id} and DELETE /v1/sessions/{id}.

Group	Endpoints
Find and measure	`GET /v1/search`, `GET /v1/analytics/{area}`, `GET /v1/prompts/{prompt}`, `GET /v1/pages`, `POST /v1/evidence/query`, `GET /v1/deciding-sources`, `GET /v1/win-plan`
The receipts	`GET /v1/memory/answers/history`, `GET /v1/memory/answers/slice`, `GET /v1/memory/citations/timeline`, `GET /v1/memory/pages/history`
Track	`POST /v1/prompts`, `DELETE /v1/prompts/{prompt}`, `POST /v1/competitors`, `DELETE /v1/competitors/{id}`
Automations	`GET`/`POST /v1/automations`, `GET`/`PATCH`/`DELETE /v1/automations/{id}`, `POST /v1/automations/{id}/runs`
Inbox	`GET /v1/inbox`, `GET /v1/inbox/items/{ref}`, `POST /v1/inbox/tasks/{id}/answer`, `POST /v1/inbox/tasks/{id}/resolve`, `POST /v1/inbox/{id}/approve`, `POST /v1/inbox/{id}/decline`, `POST /v1/inbox/asks/{id}/approve`, `POST /v1/inbox/asks/{id}/decline`
Agent	`POST /v1/ask`, `GET /v1/sessions/{id}`
Sessions	`GET /v1/sessions`, `POST /v1/sessions/{id}/cancel`, `DELETE /v1/sessions/{id}`, `POST /v1/sessions/{id}/context`
Loop health	`GET /v1/loop-health`
Account and settings	`GET /v1/account`, `GET /v1/costs`, `GET /v1/ai-traffic/install`, `GET /v1/wins`, `GET /v1/brief`, `PATCH /v1/settings/agents`, `GET /v1/github/install-url`
Memory	`POST /v1/observations`, `POST /v1/skills`
Set up a workspace	`POST /v1/onboarding/workspace`, `POST /v1/onboarding/workspace/{id}/confirm`
Goals	`GET`/`POST /v1/goals`, `PATCH /v1/goals/{id}`
Projects	`GET /v1/work-areas`, `GET /v1/work-areas/{id}`, `POST /v1/work-areas/{id}/steer`
Deliverables and reports	`GET /v1/deliverables`, `GET /v1/reports/latest`

Webhooks push events to you instead: a session finished, work filed, an article written, a change shipped, a report ready, a scheduled run skipped, a goal updated. They are managed with the same API key at https://webapp.attensira.com/v1/webhooks. The full parameter and response reference is on Endpoints.

Conventions

Versioning. The version is in the path. /v1 will not change shape under you: fields may be added, never removed or retyped. Write clients that ignore fields they do not recognise. Content type. Requests with a body send Content-Type: application/json. Every response is JSON, including every error. Unknown fields are rejected. A POST body containing a field the endpoint does not define is a 400, not a silent drop. A misspelled instructions quietly ignored is an automation that does the wrong thing forever; a 400 at the moment of the typo is cheaper. Numeric parameters are clamped, not rejected. ?limit=9999 on an endpoint capped at 50 returns 50 rows, because “as many as you can give me” is what was meant. A value that is not a number at all is a mistake rather than an intent, and returns 400. Paging. GET /v1/search takes limit and offset, and returns total and has_more. Page on has_more — total is a floor, not a grand total, and a full page is not proof there are more. The answer reads under /v1/memory/answers/ and GET /v1/deliverables page with cursor: pass the previous page’s next_cursor, which is null at the end. Every other endpoint is bounded by limit instead. Request ids. Every response carries X-Request-Id. Send your own and it is reused end to end, so one trace stays one trace. Quote it in a support request. Naming your client. Send X-Attensira-Client: <your client>, for example n8n, and the work a call starts is marked with it in the app. It is optional and a label only: it never grants or limits anything. A call without it is shown as API use. See Marked via your assistant for the names shown.

The API is rate limited per key. A 429 comes back in the standard error envelope with type: "rate_limited" — back off and retry.

Reading what comes back

Every numeric field can be null, and null never means zero. A rate is {value, n}, a delta is {value, real}, and per-platform metrics carry {tracked, readable}. tracked: false means your plan does not include that platform, so it was never queried — rendering it as 0% invents a failure that did not happen. This matters more through the API than through the dashboard, because your code is what will coerce a null into a 0 on its way into a chart. Reading the numbers covers null against zero, small n, and when a delta is worth acting on.

Next steps

Authentication

Key format, the header, what a 401 means, and how scoping works.

Endpoints

Every endpoint, with request and response examples.

Errors

One envelope, seven types, and what to retry.

Get started

What you track

Reading the numbers

Pages and AI traffic

The agent

MCP

REST API

Agencies and client reporting

Account

Reference

Attensira REST API

Which door to use

Base URL

Your first request

What the API can do

Conventions

Reading what comes back

Next steps

Authentication

Endpoints

Errors

​Which door to use

​Base URL

​Your first request

​What the API can do

​Conventions

​Reading what comes back

​Next steps

Authentication

Endpoints

Errors

Which door to use

Base URL

Your first request

What the API can do

Conventions

Reading what comes back

Next steps