curl https://api.atris.ai/v1/chat/completions -H "Authorization: Bearer atris_YOUR_KEY" -H "Content-Type: application/json" -d '{"model":"atris:auto","messages":[{"role":"user","content":"Hello"}]}'

# Atris Developer API

Base URL: https://api.atris.ai

## Authentication

Chat and billing accept a developer key as `Authorization: Bearer atris_...` or `x-atris-api-key: atris_...`, subject to its scopes. Scoped code validation uses `X-API-Key` as described below. Owner key management uses the signed-in owner's login bearer token.

Chat endpoint: `POST /v1/chat/completions` (OpenAI-compatible).

## Models

`GET /v1/models`

## Billing

Requests are billed from actual model usage at Atris rates. One credit equals $0.01. The minimum charge is $0.01 per request.

Every chat response carries an inline `atris` block with `credits_charged`, `cost_usd`, `balance_remaining_usd`, and `request_id`.

An unscoped chat/billing key can use:

- Usage: `GET /api/atris2/billing/usage?days=30`
- Quote: `GET /api/atris2/billing/quote`
- Receipts: `GET /api/atris2/billing/receipts`
- One receipt: `GET /api/atris2/billing/receipts/{request_id}`
- Top up: `POST /api/atris2/billing/topup {"amount_usd": 25}` returns a Stripe checkout link to pay in a browser.
- Limits: `GET /api/atris2/billing/limits`; lower your own cap with `POST /api/atris2/billing/limits {"monthly_spend_cap_usd": 50}` (raising it needs the dashboard).
- Auto-refill: agents can read `GET /api/atris2/billing/auto-refill`; only the signed-in owner can change the rule.

## Keys and credits

Creating, listing, inspecting, rotating and revoking keys require the owner's login bearer token. Keep that token out of the external coding agent.

- Create a key: `POST /api/developer/create-key` from the signed-in dashboard (full key shown once)
- List your keys: `GET /api/developer/keys`
- Per-key usage: `GET /api/developer/keys/{agent_id}/usage`
- Rotate a key: `POST /api/developer/keys/{agent_id}/rotate` (new secret shown once; old key stops working)
- Revoke a key: `DELETE /api/developer/keys/{agent_id}`
- Check balance: `GET /api/atris2/billing/usage?days=1` (the `balance_credits` and `balance_usd` fields; your key works here)
- Buy credits: `POST /api/credits/purchase` with `{"amount_usd": 5}` and the owner's login bearer token; allowed amounts are $5 through $500.

## Code validation

Available only for an explicitly enabled CodeOps business with a running validation computer. The owner uses `POST /api/developer/create-key` with their login bearer token, a `name`, `scopes: ["code:validate"]`, `ttl_seconds` (1–86400), and `validation_business_id` set to their approved CodeOps business UUID. Give the coding agent only the returned `api_key`, stored as `ATRIS_VALIDATION_KEY`. This expiring, owner-bound key permits validation only; it cannot chat, read billing or manage keys.

Submit `POST /api/developer/validate` with `X-API-Key` and a JSON body containing only `files` and `command`:

```sh
curl --fail-with-body https://api.atris.ai/api/developer/validate -H "X-API-Key: $ATRIS_VALIDATION_KEY" -H 'Content-Type: application/json' --data '{"files":{"test_arithmetic.py":"assert 2 + 3 == 5\n"},"command":"python3 test_arithmetic.py"}'
```

Each run uses offline Python standard-library execution with a 40-second job deadline. There is no network, package installation, provider credential access or persistent state between runs. Send the complete file map on every request; the request cannot select another business.

HTTP 200 means a run result was returned, not that tests passed. Check `exit_code`, `stdout`, `stderr`, `timed_out`, `oom_killed` and `output_truncated`; edit the files and submit again. Check non-200 responses before treating them as test failures. Owner rotation preserves the key's original expiry; owner revocation denies new submissions.