Skip to main content
The REST API is Attensira for your own code. Same data, same key, same sixteen capabilities as the MCP server — plain HTTP instead of MCP tools, so a cron job, a CI step, a dashboard or a data pipeline can reach it without speaking a protocol built for assistants.

​
Which door to use

The two surfaces are twins on purpose. Every REST endpoint has an MCP tool and every MCP tool has a REST endpoint, so a customer’s answer never depends on which door they came through. Both take the same atn_live_ key, so you do not need a second credential to add the other.

​
Base URL

Base URL
Every endpoint lives under /v1. https://api.attensira.com/healthz is unauthenticated and answers without a key, which makes it a useful reachability check when a client is silent about why it failed.

​
Your first request

Shell
Response
Call /v1/account first from a fresh integration: it confirms which workspace the key points at, and plan.platforms is the authority on which AI answer surfaces were queried at all. A platform missing from that list was never measured — which is not the same as measured at zero.

​
What the API can do

A key can delete prompts and automations and spend credits. Treat it as a workspace credential, not a read token. Three endpoints spend credits (POST /v1/prompts, POST /v1/automations/{id}/runs, POST /v1/ask) and two destroy data (DELETE /v1/prompts/{prompt}, DELETE /v1/automations/{id}).
The full parameter and response reference is on Endpoints.

​
Conventions

Versioning. The version is in the path. /v1 will not change shape under you: fields may be added, never removed or retyped. Write clients that ignore fields they do not recognise. Content type. Requests with a body send Content-Type: application/json. Every response is JSON, including every error. Unknown fields are rejected. A POST body containing a field the endpoint does not define is a 400, not a silent drop. A misspelled instructions quietly ignored is an automation that does the wrong thing forever; a 400 at the moment of the typo is cheaper. Numeric parameters are clamped, not rejected. ?limit=9999 on an endpoint capped at 50 returns 50 rows, because “as many as you can give me” is what was meant. A value that is not a number at all is a mistake rather than an intent, and returns 400. Paging. GET /v1/search takes limit and offset, and returns total and has_more. Page on has_more — total is a floor, not a grand total, and a full page is not proof there are more. No other endpoint pages; they are bounded by limit instead. Request ids. Every response carries X-Request-Id. Send your own and it is reused end to end, so one trace stays one trace. Quote it in a support request.
The API is rate limited per key. A 429 comes back in the standard error envelope with type: "rate_limited" — back off and retry.

​
Reading what comes back

Every numeric field can be null, and null never means zero. A rate is {value, n}, a delta is {value, real}, and per-platform metrics carry {tracked, readable}. tracked: false means your plan does not include that platform, so it was never queried — rendering it as 0% invents a failure that did not happen. This matters more through the API than through the dashboard, because your code is what will coerce a null into a 0 on its way into a chart. Reading the numbers covers null against zero, small n, and when a delta is worth acting on.

​
Next steps

Authentication

Key format, the header, what a 401 means, and how scoping works.

Endpoints

All sixteen endpoints with request and response examples.

Errors

One envelope, seven types, and what to retry.