1. Authenticate
Every public operation requires an owner API key in the
X-API-Key header. Required scopes are
declared per operation as x-required-scopes
in OpenAPI.
export AIPSEO_API_KEY='YOUR_API_KEY' export AIPSEO_API_BASE_URL='https://api.aipseo.com' curl --fail-with-body \ -H "X-API-Key: $AIPSEO_API_KEY" \ -H 'Accept: application/json' \ -H 'X-Request-ID: req_example' \ "$AIPSEO_API_BASE_URL/v1/capabilities"
2. Discover capabilities
GET /v1/capabilities is available to every
valid active key and returns effective scopes plus resource/concurrency
hints. Prefer discovery over hard-coding assumptions.
3. Correlation and errors
Clients may send optional X-Request-ID
(1–128 ASCII letters, digits, ._:-).
Every response returns the effective request ID. Failures use
PublicErrorEnvelope — see
Errors.
4. Mutate safely
- Versioned mutations require
If-Match-Version(Concurrency). - Selected creates/binding writes accept
Idempotency-Key(Idempotency). PUT /v1/qr/{short_id}/paywallis a documented exception without version/idempotency/audit coverage.