Control plane API

Base URL and scope

https://api.intelligentinference.ai/api

Every endpoint operates on the caller's own organisation, resolved from the session. There is no organisation id in any request and no way to address another organisation: a project or key id from elsewhere answers 404, never a silent empty result.

Authentication

Sessions, not bearer tokens. POST /api/auth/login (or /auth/google) sets two HttpOnly cookies:

Both are SameSite=Lax and Secure. There is no CSRF token to send; SameSite=Lax is the defence. A request with no cookie, an expired one, or one for a deactivated user answers 401 {"detail": "Unauthorized"}.

With cURL, keep a cookie jar:

curl -c cookies.txt -X POST https://api.intelligentinference.ai/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email": "you@company.com", "password": "…"}'

curl -b cookies.txt https://api.intelligentinference.ai/api/auth/me

Refresh before the access token lapses (or on the first 401), then retry:

curl -b cookies.txt -c cookies.txt -X POST https://api.intelligentinference.ai/api/auth/refresh

Roles

role on your account is owner (you created the organisation), admin, or member (you joined one that existed). Nothing in this API changes a role after sign-up. Renaming the organisation is the one operation that checks it: it needs owner or admin. Everything else in this reference is open to any member.

Conventions

• Units. Every _cents field is micro-PKR (1 PKR = 1,000,000). _pkr fields are the same value divided by 1,000,000. Never treat _cents as currency.
• Nulls mean unknown. Averages over an empty window, a first-token time on a non-streaming request, a name for a deleted key: all null, never 0 or "".
• Paging is limit/offset. limit is clamped to 200 server-side; check the response's own limit.
• Blank query parameters equal omitted ones (project_id= is the same as no project_id).
• Errors are {"error": "…"} with a human sentence, or DRF-style {"detail": …} for schema validation. See Error responses.

Endpoint map

Note The control plane is the same API the dashboard calls, through a same-origin relay, so anything you can do in the dashboard you can script here. Some platform operations have no endpoint at all today: changing a member's role, and resetting a password.