ARIA API Reference

The ARIA API lets you integrate AI conversation, persistent memory, and agent execution into your applications. All endpoints return JSON. The base URL for all API calls is:

Base URL: https://avgsux.com  ·  All responses: application/json  ·  TLS required

Authentication

ARIA supports two authentication methods depending on your use case:

Bearer Token (recommended for integrations)
Generate an API key from Settings → API Keys inside ARIA. Pass it as a Bearer token on every request:
Authorization: Bearer aria_your_key_here
Session Cookie (browser / internal use)
Log in via POST /auth/login to receive a session cookie. All subsequent requests from the same browser session are automatically authenticated.

API Keys

Auth required
GET/api/keysList your API keys

Returns all active API keys for the authenticated user. Raw key values are never returned after creation.

Response
{"keys": [{"id": 1, "name": "My App", "prefix": "aria_abc1", "scopes": "chat:write memory:read", "is_active": true, "created_at": "2026-03-01T12:00:00"}]}
POST/api/keysCreate an API key

Generates a new API key. The full key is returned once — copy it immediately. Maximum 10 active keys per account.

FieldTypeReq?Description
namestringOptionalLabel for this key (max 64 chars). Defaults to "Default".
Response
{"ok": true, "key": "aria_abc123...", "id": 1, "prefix": "aria_abc1", "name": "My App", "note": "Store this key securely — it will not be shown again."}
DEL/api/keys/:idRevoke an API key

Permanently revokes the key. The key stops working immediately.

Response
{"ok": true, "revoked": 1}

Errors & Rate Limits

All errors return a JSON body with an error key. Standard HTTP status codes apply.

CodeMeaning
400Bad request — missing or invalid parameter
401Unauthenticated — missing or invalid API key / session
403Forbidden — API key missing required scope
404Resource not found
429Rate limit exceeded — back off and retry
500Internal server error
Rate limits (Public API v1)
POST /api/v1/chat     → 60 requests/minute · 500 requests/hour
GET  /api/v1/memory/* → 120 requests/minute
GET  /api/v1/agents   → 60 requests/minute

Public API v1

Bearer token
All v1 endpoints require Authorization: Bearer aria_your_key_here. Keys are scoped — a key needs the relevant scope for each endpoint (e.g. chat:write, memory:read). Scopes are shown on each endpoint below.
GET/api/v1/healthHealth check — no auth required

Returns platform status. Use this to confirm the API is reachable before making authenticated requests.

Response
{"status": "ok", "version": "1.0.0", "docs": "/api/v1/openapi.json"}
POST/api/v1/chatSend a message to ARIA

Send a message and receive ARIA's full response. Processes through the full agent pipeline — memory recall, specialist routing, tool execution. Scope required: chat:write

FieldTypeReq?Description
messagestringRequiredThe user message to send to ARIA
conversation_idstringOptionalUUID to continue an existing conversation. A new UUID is generated if omitted.
modelstringOptionalOverride the AI model for this request (e.g. claude-opus-4-6). Defaults to account setting.
Request
POST /api/v1/chat
Authorization: Bearer aria_your_key_here
Content-Type: application/json

{
  "message": "Write a subject line for our Black Friday campaign",
  "conversation_id": "550e8400-e29b-41d4-a716-446655440000"
}
Response
{
  "reply": "Here are five subject lines optimised for open rate...",
  "conversation_id": "550e8400-e29b-41d4-a716-446655440000",
  "model_used": "claude-sonnet-4-6"
}
GET/api/v1/memory/search?q=<query>Search ARIA's memory

Full-text search across ARIA's persistent memory for the API key owner's account. Returns ranked results. Scope required: memory:read

ParameterTypeReq?Description
qstringRequiredSearch query
limitintegerOptionalMaximum results to return (default 10, max 50)
Response
{
  "results": [
    {"key": "client_abc_notes", "value": "Prefers email on Tuesdays...", "score": 0.94},
    {"key": "product_pricing", "value": "Pro plan at $49/month...", "score": 0.81}
  ],
  "count": 2
}
GET/api/v1/agentsList available specialist agents

Returns the full list of specialist agents available on this ARIA instance. Use agent names to direct conversations to specific areas of expertise. Scope required: agents:read

Response
{
  "agents": [
    {"name": "Marketing Strategist", "domain": "marketing", "description": "Campaign strategy, positioning, messaging"},
    {"name": "Financial Analyst",    "domain": "finance",    "description": "Forecasting, modelling, reporting"},
    ...
  ],
  "count": 212
}

Session Auth

POST/auth/loginSign in with email + password

Returns a session cookie on success. Rate-limited to 10 requests/minute per IP.

FieldTypeReq?Description
emailstringRequiredRegistered email address
passwordstringRequiredAccount password
POST/auth/registerCreate a new account

First registered user becomes the owner. Subsequent registrations create standard users.

FieldTypeReq?Description
emailstringRequiredEmail address (must be unique)
passwordstringRequiredPassword (minimum 8 characters)
namestringRequiredDisplay name
POST/auth/logoutEnd the current session

Clears session cookie. Redirects to /login.

Chat (Session)

Auth required
POST/api/chatSend a message (SSE streaming)

Primary chat endpoint used by the ARIA web app. Returns a Server-Sent Events stream. Each event is a JSON object on a data: line.

FieldTypeReq?Description
messagestringRequiredUser message text
session_idstringOptionalConversation UUID (auto-generated if omitted)
SSE event types
data: {"type": "status",  "text": "Routing to Financial Analyst..."}
data: {"type": "delta",   "text": "Here is your Q1 forecast:\n\n"}
data: {"type": "delta",   "text": "Revenue: $142,000..."}
data: {"type": "done",    "session_id": "550e8400-...", "tokens": 312}

Conversations

Auth required
GET/api/conversationsList conversation history

Returns the 50 most recent conversations for the authenticated user, sorted by last activity.

GET/api/conversations/:idLoad a specific conversation

Returns the full message history for the specified conversation ID.

DEL/api/conversations/:idDelete a conversation

Permanently removes the conversation and all its messages.

Business Directive

Auth required
GET/api/directiveGet business context directive

Returns the current business directive content that ARIA uses to personalise every response.

Response
{"content": "# My Business\nWe sell...", "is_blank": false}
POST/api/directiveSave business directive

Update ARIA's business context. Accepts either raw markdown or structured fields.

FieldTypeDescription
rawstringFull markdown content (use this OR the structured fields below)
business_namestringYour business name
business_typestringType / industry
stagestringe.g. "early-stage", "growth", "enterprise"
goalsstringPrimary business goals
customersstringTarget customer description
tonestringCommunication tone (e.g. "professional", "friendly")

WhatsApp Webhook

GET/whatsapp/webhookMeta verification handshake

Required by Meta during webhook setup. Verifies hub.verify_token against WHATSAPP_VERIFY_TOKEN env var. Returns hub.challenge on success.

POST/whatsapp/webhookReceive incoming messages

Meta delivers message events here. ARIA routes each message through the full agent pipeline and replies automatically. Returns 200 immediately — processing is asynchronous.

Billing Webhook

POST/billing/webhookStripe event delivery

Stripe delivers subscription and payment events here. Signature verification is performed using STRIPE_WEBHOOK_SECRET. Do not call this endpoint directly.

Privacy & GDPR

Auth required
GET/api/sessions/exportExport your data (GDPR Art. 20)

Downloads a full JSON export of your account data — conversations, memory, profile. Rate-limited to 5 requests/minute.

GET/api/privacy/data-sharingGet collective learning preference

Returns whether your account contributes anonymised patterns to collective intelligence. Default: true (opted in).

Response
{"data_sharing": true}
POST/auth/delete-accountDelete account & all data (GDPR Art. 17)

Permanently erases all data for the authenticated user. Requires password confirmation. The owner account cannot be deleted while users remain on the platform.

FieldTypeReq?Description
passwordstringRequiredCurrent password for confirmation

System

Public
GET/healthPlatform health — no auth required

Returns platform health, version, counts, and component status. Used by load balancers and uptime monitors.

Response
{
  "status":  "healthy",
  "version": "1.0.0",
  "agents":  212,
  "skills":  18,
  "tools":   191,
  "db":      "ok",
  "llm":     "ok",
  "users":   4
}
GET/api/v1/openapi.jsonOpenAPI 3.0 specification

Machine-readable OpenAPI spec for the v1 public API. Import into Postman, Insomnia, or any OpenAPI-compatible tool.