API Reference
API Reference
REST API overview, authentication, and rate limiting
Pramiti exposes a comprehensive REST API with 330+ endpoints across 60+ routers, organized by domain. The API supports three deployment modes with different endpoint sets.
API Entry Points
| Entry Point | File | Endpoints | Use Case |
|---|---|---|---|
| Combined | main.py | All routers | Full platform deployment |
| Praxom Only | praxom_main.py | Praxom + platform routers | Action validation only |
| Epistom Only | epistom_main.py | Epistom + platform routers | Semantic intelligence only |
Authentication
The API supports multiple authentication modes:
| Mode | When | How |
|---|---|---|
demo | Local development | X-Demo-User header or the epistom_token demo cookie |
| (empty) | Default JWT/session (auth_mode="") | JWT via the epistom_session cookie or Authorization: Bearer header |
disabled | Testing | EPISTOM_AUTH_DISABLED=true (no auth check) |
API keys (ek_* prefix) are supported for programmatic access with per-key rate limit buckets.
Rate Limiting
Rate limiting is applied per-key with the following priority:
- Demo user header (demo mode only)
- API key hash (SHA-256 prefix)
X-Forwarded-Forheader- Remote IP address
EPISTOM_RATE_LIMIT=100 # Requests per minute (0 = disabled)
EPISTOM_RATE_LIMIT_REDIS_URL=... # Required for multi-pod deploymentsCSRF Protection
CSRF middleware is active when auth_mode != "demo". Frontend clients send X-Epistom-CSRF: 1 on state-mutating methods (POST, PUT, DELETE, PATCH).
Health Endpoints
GET /health — Liveness probe
GET /readyz — Readiness probe
GET /api/v1/health-check — Detailed health check