Authentication

Everything the dashboard does is available over the API. It is a plain REST service, so any language that can make an HTTP request can use it.

Base URL

https://api.glytos.com/api/v1

API keys

Create a key under API keys in the dashboard. It is shown once, at creation - it is stored hashed and cannot be retrieved afterwards. If you lose it, create another and delete the old one.

Send it as a bearer token:

curl https://api.glytos.com/api/v1/workflows \
  -H "Authorization: Bearer $GLYTOS_API_KEY"

$client = new \GuzzleHttp\Client(['base_uri' => 'https://api.glytos.com/api/v1/']);

$response = $client->get('workflows', [
    'headers' => ['Authorization' => 'Bearer ' . getenv('GLYTOS_API_KEY')],
]);
$agents = json_decode((string) $response->getBody(), true);

req, _ := http.NewRequest("GET", "https://api.glytos.com/api/v1/workflows", nil)
req.Header.Set("Authorization", "Bearer "+os.Getenv("GLYTOS_API_KEY"))

resp, err := http.DefaultClient.Do(req)
if err != nil {
    return err
}
defer resp.Body.Close()

require 'net/http'

uri = URI('https://api.glytos.com/api/v1/workflows')
request = Net::HTTP::Get.new(uri)
request['Authorization'] = "Bearer #{ENV['GLYTOS_API_KEY']}"

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |http| http.request(request) }

using var client = new HttpClient();
client.DefaultRequestHeaders.Authorization =
    new AuthenticationHeaderValue("Bearer", Environment.GetEnvironmentVariable("GLYTOS_API_KEY"));

var agents = await client.GetStringAsync("https://api.glytos.com/api/v1/workflows");

An API key belongs on your server, never in a browser, a mobile app or a public repository. For voice in a browser, mint a short-lived web-call token server-side instead - see Web calls.

Scope and expiry

A key belongs to one organization, and requests act within it. To work across organizations, use a key from each.

Two optional limits, both set when the key is created and neither changeable afterwards:

Field	Effect
`expires_in_days`	The key stops working on that date. Omit it and the key never expires.
`scopes`	The permissions the key may use, as a list. Omit it and the key inherits whoever created it.

Give a key scopes if it will outlive the person who made it. An unscoped key is evaluated against its creator's current permissions, so it stops working when they leave the organization or are demoted. A scoped key carries its own permissions and keeps working; it can never be created with more than its author holds at the time.

Omitting both is exactly the behaviour keys have always had, so existing keys are unaffected.

Starting a conversation

Open a text session against an agent, seeding any variables it should know:

curl -X POST https://api.glytos.com/api/v1/workflows/$AGENT_UUID/sessions \
  -H "Authorization: Bearer $GLYTOS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"variables": {"customer_name": "Ada"}}'

import { Glytos } from '@glytos/node';

const glytos = new Glytos({ apiKey: process.env.GLYTOS_API_KEY! });
const session = await glytos.request('POST', `/workflows/${agentUuid}/sessions`, {
  body: { variables: { customer_name: 'Ada' } },
});

from glytos import Glytos

glytos = Glytos(api_key=os.environ["GLYTOS_API_KEY"])
session = glytos.request(
    "POST",
    f"/workflows/{agent_uuid}/sessions",
    json={"variables": {"customer_name": "Ada"}},
)

$session = Http::withToken(config('services.glytos.key'))
    ->baseUrl('https://api.glytos.com/api/v1')
    ->post("workflows/{$agentUuid}/sessions", [
        'variables' => ['customer_name' => 'Ada'],
    ])
    ->json();

Then read the reference for everything else, or use an SDK and skip the plumbing.