API Reference

Base URL, authentication, endpoints, response format, and status codes for the Creed Space API.

Base URL

https://api.creed.space

Authentication

The evaluation and adjudication endpoints (/api/v1/safety/evaluate, /api/v1/pdp/adjudicate) take an API key:

curl -H "X-API-Key: cs_live_..." https://api.creed.space/api/v1/safety/evaluate

Account-management endpoints, such as the metrics summary and API key management below, need a signed-in dashboard session (session cookie or login JWT) and reject API keys.

See Authentication for details.

Endpoints Overview

Safety

Method	Endpoint	Description
POST	/api/v1/safety/evaluate	Score text for agent-dysfunction risk
GET	/api/v1/safety/metrics/summary	Get safety metrics summary. Dashboard session only; not API key

PDP (Policy Decision Point)

Method	Endpoint	Description
POST	/api/v1/pdp/adjudicate	Get policy decision

Constitutions

Method	Endpoint	Description
GET	/api/v1/constitutions	List constitutions
GET	/api/v1/constitutions/{relativePath}/content	Get constitution content

API Keys

These routes are dashboard-session only. They return 401 for X-API-Key or Bearer cs_live_... credentials.

Method	Endpoint	Description
POST	/api/v1/ssaas/keys	Create API key
GET	/api/v1/ssaas/keys	List API keys
GET	/api/v1/ssaas/keys/{key_id}	Get key details
DELETE	/api/v1/ssaas/keys/{key_id}	Revoke key
POST	/api/v1/ssaas/keys/{key_id}/rotate	Rotate key

Health

Method	Endpoint	Description
GET	/health	Health check (no auth)

Response Format

All responses are JSON. Response bodies differ by endpoint; see each endpoint's page for its documented response (for example, Safety Evaluation nests its result under evaluation, and PDP Adjudication returns the decision kernel at the top level).

API-key authentication (401) and scope (403) errors follow RFC 7807 (Content-Type: application/problem+json):

{
  "type": "https://api.creed.space/problems/invalid-api-key",
  "title": "Invalid API Key",
  "status": 401,
  "detail": "API key is invalid or not found."
}

The type URI ends in a problem-type code: invalid_api_key or scope_required. Validation errors (422), rate limits (429) and other errors use different shapes; see Error Handling.

HTTP Status Codes

Code	Meaning
200	Success
201	Created
400	Bad request
401	Unauthorized (invalid/missing API key or session)
403	Forbidden (insufficient permissions)
404	Not found
422	Validation error (invalid request body)
429	Rate limited
500	Server error
503	Service temporarily unavailable

Rate Limits

A key with no custom limit falls back to the per-route limit — 100 requests/minute for POST /api/v1/safety/evaluate — with no daily cap. A per-key rate_limit_rpm and/or rate_limit_rpd overrides that. See Rate Limits for the full header set.

Rate limit headers are included in responses:

X-RateLimit-Limit: 100
X-RateLimit-Remaining: 95
X-RateLimit-Reset: 1704067200