> ## Documentation Index
> Fetch the complete documentation index at: https://spillway.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# API reference

> Every data-plane and control-plane endpoint, generated from the request/response schemas the server actually validates.

The endpoints in this section are generated directly from Spillway's OpenAPI spec
(`pnpm build:openapi` in the monorepo), which is itself generated from the request/response
zod schemas the server validates every call against — the spec can't drift from what the
server actually does.

## Base URLs

| Environment | URL |
| - | - |
| Local dev | `http://localhost:3000` |

## Authentication

Spillway has three credential types, scoped to different planes:

| Credential | Plane | How |
| - | - | - |
| Virtual key (`mk-live-…`) | Data (`/v1/*`) | `Authorization: Bearer mk-live-…` or `x-api-key: mk-live-…` |
| Session token | Control (`/api/*`) | Set by the dashboard's WorkOS AuthKit login flow. |
| Admin key (`mk-admin-…`) | Control (`/api/*`) | `Authorization: Bearer mk-admin-…` **plus** an `X-Spillway-Org` header naming the org to act on. |

A virtual key never authenticates the control plane, and a session token or admin key never
authenticates the data plane — the two credential families don't cross over.

> [!WARNING]
>
> Admin-key authentication is **not yet enabled**. Admin keys can be minted, revealed once,
> listed, and revoked via `/api/admin-keys`, but no request path verifies them yet — a
> minted key currently grants no access. Use a session token (dashboard login) for
> control-plane calls until admin-key verification ships.

## The two planes, at a glance

* **Data plane** (`/v1/*`) — `POST /v1/chat/completions`, `POST /v1/messages`,
  `GET /v1/models`. The gateway itself.
* **Control plane** (`/api/*`) — everything else: orgs, teams, members, provider keys,
  virtual keys, admin keys, budgets, guardrail policies, routing rules, aliases, approvals,
  approval policies, delegations, automation rules, alerts, decision logs, requests, and
  reports.

## Errors

See [Errors](https://spillway.mintlify.site/api-reference/errors.md) for response shapes and the full stable error-code
taxonomy.

## Regenerating this reference

```bash theme={null}
pnpm build:openapi
```

Run from the monorepo root, then copy the resulting `apps/docs/reference/openapi.json` over
`docs-mintlify/api-reference/openapi.json` — the docs site keeps its own copy so this
directory can be published independently of the app build.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.