Authentication

Everything the dashboard does is available over the API. It is a plain REST service, so any language that can make an HTTP request can use it.

Base URL

https://api.glytos.com/api/v1

API keys

Create a key under API keys in the dashboard. It is shown once, at creation - it is stored hashed and cannot be retrieved afterwards. If you lose it, create another and delete the old one.

Send it in the X-API-Key header:

curl https://api.glytos.com/api/v1/workflows \
  -H "X-API-Key: $GLYTOS_API_KEY"

$client = new \GuzzleHttp\Client(['base_uri' => 'https://api.glytos.com/api/v1/']);

$response = $client->get('workflows', [
    'headers' => ['X-API-Key' => getenv('GLYTOS_API_KEY')],
]);
$agents = json_decode((string) $response->getBody(), true);

req, _ := http.NewRequest("GET", "https://api.glytos.com/api/v1/workflows", nil)
req.Header.Set("X-API-Key", os.Getenv("GLYTOS_API_KEY"))

resp, err := http.DefaultClient.Do(req)
if err != nil {
    return err
}
defer resp.Body.Close()

require 'net/http'

uri = URI('https://api.glytos.com/api/v1/workflows')
request = Net::HTTP::Get.new(uri)
request['X-API-Key'] = ENV['GLYTOS_API_KEY']

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |http| http.request(request) }

using var client = new HttpClient();
client.DefaultRequestHeaders.Add("X-API-Key", Environment.GetEnvironmentVariable("GLYTOS_API_KEY"));

var agents = await client.GetStringAsync("https://api.glytos.com/api/v1/workflows");

An API key is only accepted in X-API-Key. The Authorization: Bearer header is reserved for signed-in dashboard sessions, so an API key sent as a bearer token is rejected with 401.

An API key belongs on your server, never in a browser, a mobile app or a public repository. For voice in a browser, mint a short-lived web-call token server-side instead - see Web calls.

Scope and expiry

A key belongs to one organization, and requests act within it. To work across organizations, use a key from each.

Two optional limits, both set when the key is created and neither changeable afterwards:

Field	Effect
`expires_in_days`	The key stops working that many days after creation (1 to 3650). Omit it and the key never expires.
`scopes`	The permissions the key may use, as a list. Omit it and the key inherits whoever created it.

Scopes are permission names:

Scope	Allows
`workflow:read`	View agents, sessions, calls and analytics
`workflow:write`	Create and edit agents
`workflow:publish`	Publish and promote agents
`workflow:run`	Run agents: start calls and sessions, mint web-call and chat tokens
`knowledge_base:read`	View the knowledge base
`knowledge_base:write`	Edit the knowledge base
`org:read`	View phone numbers, tools, campaigns, the do-not-call list, integrations, automations and webhook endpoints
`org:manage`	Change those, and organization settings, API keys and billing
`member:read`	View members, the audit trail, API keys and API request logs
`member:manage`	Invite and manage members
`role:manage`	Manage roles

Give a key scopes if it will outlive the person who made it. An unscoped key is evaluated against its creator's current permissions, so it loses access when they leave the organization or are demoted. A scoped key carries its own permissions and keeps working; creating one with a permission its author does not hold is refused with 400 (invalid_scope).

Omitting both is exactly the behaviour keys have always had, so existing keys are unaffected.

A few account endpoints - creating and switching organizations - need a signed-in dashboard session and refuse an API key with 403 (user_session_required).

Environments

A request acts in one environment. Name it with the X-Environment-Id header - dev, staging, prod, or an environment uuid. Without the header, requests use the organization's default environment. An unrecognised value is not an error: it silently falls back to the default too, so check the spelling if a list comes back empty.

Starting a conversation

Open a text session against an agent, seeding any variables it should know:

curl -X POST https://api.glytos.com/api/v1/workflows/$AGENT_UUID/sessions \
  -H "X-API-Key: $GLYTOS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"variables": {"customer_name": "Ada"}}'

import { Glytos } from '@glytos/node';

const glytos = new Glytos({ apiKey: process.env.GLYTOS_API_KEY! });
const session = await glytos.request('POST', `/workflows/${agentUuid}/sessions`, {
  body: { variables: { customer_name: 'Ada' } },
});

from glytos import Glytos

glytos = Glytos(api_key=os.environ["GLYTOS_API_KEY"])
session = glytos.request(
    "POST",
    f"/workflows/{agent_uuid}/sessions",
    json={"variables": {"customer_name": "Ada"}},
)

$session = Http::withHeaders(['X-API-Key' => config('services.glytos.key')])
    ->baseUrl('https://api.glytos.com/api/v1')
    ->post("workflows/{$agentUuid}/sessions", [
        'variables' => ['customer_name' => 'Ada'],
    ])
    ->json();

Then read the reference for everything else, or use an SDK and skip the plumbing.