Does Chazz.ai have an API?

Yes. One JSON HTTP API at api.chazz.ai, authenticated with a bearer token, which the website and every connector call. A machine-readable description is at /openapi.json. There is no self-service developer key yet, though the scoped, rotatable machine credentials it would use already exist.

Is there a GraphQL endpoint?

No. The API is JSON over HTTP, so there is no GraphQL introspection surface.

API · Chazz.ai

The Chazz.ai HTTP API: one authenticated JSON endpoint behind a bearer token, the same one the website and every chat-app connector calls. Machine-readable description at /openapi.json.

Chazz.ai exposes one JSON HTTP API at api.chazz.ai. Every surface of the product calls it, including the website and the chat-app connectors, so anything the site can do the API can do. Access is by bearer token issued through single sign-on. A machine-readable description is published at /openapi.json.

Shape

One action-dispatch endpoint taking JSON and returning JSON, plus a small number of streaming and media routes. Authentication is a bearer token in the Authorization header, issued by the platform identity service. Cookies are not used for API authentication, which is why there is no CSRF token to carry.

Base URL: https://api.chazz.ai
Auth: Authorization: Bearer <token>
Content type: application/json
Streaming: Server-sent events for chat turns
Realtime: WebSocket for multiplayer, campaign and live avatar rooms
Machine-readable: https://chazz.ai/openapi.json

Limits, and why they are published

Publishing the limits is deliberate. An undocumented limit is discovered by hitting it, which is indistinguishable from abuse, and a client that cannot see the ceiling writes a retry loop that looks like an attack.

Per-action rate limits with a 429 and a Retry-After. A client that honours it is never blocked for honouring it.
Request bodies are size-capped, and a body over the cap is refused rather than truncated.
List endpoints are page-capped. Asking for a larger page returns the cap, not an error, and never the whole table.
Priced actions check the wallet before doing the work, and the price is returned with the result.

Credentials, and what holds them back

Access is through an account, with the same entitlements, credits, moderation and age gating that account has on the website. There is no self-service developer key you can generate from a settings page, and that is the only sense in which there is "no API key programme": the machinery underneath already exists and is used by every connector.

A machine identity on this platform is not a flat key with full access. It carries scopes, written as domain.action with an optional resource, and three rules apply to every one of them:

Rotation is built in. Long-lived credentials rotate through an operator endpoint that is classed as a dangerous operation, which means a valid session is not enough on its own: it requires a fresh proof of presence, because a stolen-but-still-valid session is the whole attack. Session refresh tokens rotate on every single use, with the old one tombstoned so a replay is detectable rather than merely expired. Every rotation is written to an audit trail.

What is missing is the self-service half: a page where you generate a key, choose its scopes and revoke it yourself. That is a product decision rather than a security gap, and the scoping and rotation it would rely on are already there.

There is no GraphQL endpoint, so there is no introspection surface to abuse.

Its grant is intersected with the site that owns it, so a machine can never be provisioned with more reach than the thing it belongs to.
A denial list is stapled on that no grant can override. Machine identities can never hold billing, payment keys, provider keys or wallet grants.
An identity that runs model output is treated as the least trusted thing on the platform and denied more still, on the assumption that anything it can reach is reachable by a prompt.

Versioning

Actions are additive. An existing action keeps its shape, new fields are optional, and a breaking change ships as a new action name rather than a silent change to an old one. Anything genuinely removed answers 410 rather than 404, so a client can tell "gone" from "typo".

If you are building something

Say hello at contact@cognitive-industries.org first. The connectors in integrations are the reference implementations, and they are the fastest way to see the intended shape.

Questions

Does Chazz.ai have an API?: Yes. One JSON HTTP API at api.chazz.ai, authenticated with a bearer token, which the website and every connector call. A machine-readable description is at /openapi.json. There is no self-service developer key yet, though the scoped, rotatable machine credentials it would use already exist.
Is there a GraphQL endpoint?: No. The API is JSON over HTTP, so there is no GraphQL introspection surface.

Elsewhere on Chazz.ai

This document is the server-rendered form of /api. The interactive page needs JavaScript, and shows the same content.

The complete documentation of this service is available as one plain-text file at /llms-full.txt. A short summary, with the operator's policy for automated readers, is at /llms.txt. Changes are published as a feed at /rss.xml.

Chazz.ai is operated by Cognitive Industries, ABN 62 794 528 747, Australia. Contact: contact@cognitive-industries.org.