Skip to main content
Xenovia exposes two HTTP surfaces. This reference covers the management API served by the control plane. Inference traffic goes to the runtime instead, at your proxy’s base URL, and is documented under Integrations. The two credentials are not interchangeable: the management API rejects xe_… keys and the runtime rejects ak_… keys. See Authentication.

​
Base URL

The OpenAPI document is published at https://cp.xenovia.io/openapi.json; the endpoint pages in this reference are generated from it.

​
What you can do

Proxies

Create proxies, attach a provider, define capabilities and role intents, activate them, and read the policy input schema observed in their traffic.

Policies and templates

Create Rego policies or instantiate one of the 55 templates, attach them to a proxy and enable them in monitor or enforce mode.

Sessions and traces

Read sessions, turns and steps, flat trace records with custom-property filters, aggregate stats and multi-proxy workflows.

Alerts

Manage event and metric alert rules, notification channels and the alert episode history.

​
Conventions

  • JSON everywhere. Request and response bodies are application/json.
  • Identifiers. Proxies, providers, policies, sessions and traces use UUIDs. The org_id path parameter is the Clerk organization id (org_…), visible under Settings in the dashboard.
  • Status codes. 201 on create and attach, 204 on delete and other empty responses, 200 otherwise. See Errors and Limits.
  • Pagination. List endpoints take limit (default 20, maximum 100) and offset (default 0) and return { "items": [...], "total": n, "limit": n, "offset": n }. Alert events and notifications default to 50, alert rules to 100. Capabilities, role configs, deployments and policy templates return a bare array instead.
  • Request ids. Every response carries an X-Request-ID header. Send your own value to have it echoed and recorded in the audit log; otherwise one is generated.
  • No idempotency keys. Retrying a POST creates a second resource, or returns 409 where names are unique (proxies, providers, policies, capabilities).
  • Propagation. Configuration changes are written through to the runtime immediately and revalidated by each runtime instance about every five minutes. A change to a proxy, provider, policy, capability or intent trigger is live within that window.

​
Tenancy

Every request is scoped to one organization: the organization that owns the API key, or the organization selected in the dashboard session. Resources that belong to another organization return 404, not 403.