> ## Documentation Index > Fetch the complete documentation index at: https://docs.attensira.com/llms.txt > Use this file to discover all available pages before exploring further. # Attensira REST API > Read your workspace and change it from your own code, over conventional HTTP, using the same workspace-scoped API key as the MCP server. The REST API is Attensira for your own code. Same data, same key, same sixteen capabilities as the [MCP server](/mcp/overview) — plain HTTP instead of MCP tools, so a cron job, a CI step, a dashboard or a data pipeline can reach it without speaking a protocol built for assistants. ## Which door to use The two surfaces are twins on purpose. Every REST endpoint has an MCP tool and every MCP tool has a REST endpoint, so a customer's answer never depends on which door they came through. | Use | When | | --------------------------- | --------------------------------------------------------------------------------------------------------------------------- | | [MCP server](/mcp/overview) | An assistant is doing the work — Claude Code, Cursor, ChatGPT. The assistant discovers the tools and decides which to call. | | **REST API** | Your code is doing the work — a nightly export, a deploy check, an internal dashboard, a Zapier or n8n HTTP step. | Both take the same `atn_live_` key, so you do not need a second credential to add the other. ## Base URL ```text Base URL theme={null} https://api.attensira.com ``` Every endpoint lives under `/v1`. `https://api.attensira.com/healthz` is unauthenticated and answers without a key, which makes it a useful reachability check when a client is silent about why it failed. ## Your first request ```bash Shell theme={null} curl https://api.attensira.com/v1/account \ -H "Authorization: Bearer atn_live_" ``` ```json Response theme={null} { "org": { "id": "org_...", "name": "Acme" }, "project": { "id": "prj_...", "name": "Acme", "domain": "acme.com" }, "plan": { "name": "Growth", "platforms": ["chatgpt", "perplexity"] }, "credits": { "balance": 4200, "renews": "2026-10-01T00:00:00Z" }, "scopes": ["read", "write"] } ``` Call `/v1/account` first from a fresh integration: it confirms which workspace the key points at, and `plan.platforms` is the authority on which AI answer surfaces were queried at all. A platform missing from that list was never measured — which is not the same as measured at zero. ## What the API can do A key can delete prompts and automations and spend credits. Treat it as a workspace credential, not a read token. Three endpoints spend credits (`POST /v1/prompts`, `POST /v1/automations/{id}/runs`, `POST /v1/ask`) and two destroy data (`DELETE /v1/prompts/{prompt}`, `DELETE /v1/automations/{id}`). | Group | Endpoints | | ---------------- | --------------------------------------------------------------------------------------------------- | | Find and measure | `GET /v1/search`, `GET /v1/analytics/{area}`, `GET /v1/prompts/{prompt}`, `GET /v1/pages` | | Track | `POST /v1/prompts`, `DELETE /v1/prompts/{prompt}`, `POST /v1/competitors` | | Automations | `GET`/`POST /v1/automations`, `GET`/`DELETE /v1/automations/{id}`, `POST /v1/automations/{id}/runs` | | Agent | `POST /v1/ask`, `GET /v1/sessions/{id}` | | Account | `GET /v1/account`, `GET /v1/ai-traffic/install` | The full parameter and response reference is on [Endpoints](/api/endpoints). ## Conventions **Versioning.** The version is in the path. `/v1` will not change shape under you: fields may be added, never removed or retyped. Write clients that ignore fields they do not recognise. **Content type.** Requests with a body send `Content-Type: application/json`. Every response is JSON, including every error. **Unknown fields are rejected.** A `POST` body containing a field the endpoint does not define is a `400`, not a silent drop. A misspelled `instructions` quietly ignored is an automation that does the wrong thing forever; a `400` at the moment of the typo is cheaper. **Numeric parameters are clamped, not rejected.** `?limit=9999` on an endpoint capped at 50 returns 50 rows, because "as many as you can give me" is what was meant. A value that is not a number at all is a mistake rather than an intent, and returns `400`. **Paging.** `GET /v1/search` takes `limit` and `offset`, and returns `total` and `has_more`. Page on `has_more` — `total` is a floor, not a grand total, and a full page is not proof there are more. No other endpoint pages; they are bounded by `limit` instead. **Request ids.** Every response carries `X-Request-Id`. Send your own and it is reused end to end, so one trace stays one trace. Quote it in a support request. The API is rate limited per key. A `429` comes back in the standard [error envelope](/api/errors) with `type: "rate_limited"` — back off and retry. ## Reading what comes back Every numeric field can be `null`, and `null` never means zero. A rate is `{value, n}`, a delta is `{value, real}`, and per-platform metrics carry `{tracked, readable}`. `tracked: false` means your plan does not include that platform, so it was never queried — rendering it as 0% invents a failure that did not happen. This matters more through the API than through the dashboard, because your code is what will coerce a `null` into a `0` on its way into a chart. [Reading the numbers](/measure/reading-the-numbers) covers null against zero, small `n`, and when a delta is worth acting on. ## Next steps Key format, the header, what a 401 means, and how scoping works. All sixteen endpoints with request and response examples. One envelope, seven types, and what to retry.