API Reference

Thotis RAG API endpoints for programmatic access to agents, sessions, and messages.

All internal API endpoints require authentication via session cookies (for Makerkit console) or API keys (for embed and external integrations).

The embed endpoint (/api/embed/{agentKey}) is public but protected by domain allowlisting and rate limiting.

POST /api/embed/{agentKey}
Content-Type: application/json

{
  "question": "What is Parcoursup?",
  "session_id": "optional-uuid",
  "stream": true
}

Response (streaming): text/event-stream with data: {"answer": "...", "done": false} events.

Response (non-streaming): application/json with { "answer": "...", "session_id": "..." }.

Field	Type	Required	Description
`question`	string	Yes	User message (1-4000 chars)
`session_id`	UUID	No	Existing session ID. Auto-created if omitted
`user_id`	string	No	User identifier for tracking
`user_hash`	string	No	HMAC hash for identity verification
`stream`	boolean	No	Enable SSE streaming (default: false)

These endpoints are used by the Makerkit control plane and require authenticated sessions.

POST /api/internal/rag/publish
{
  "agent_id": "uuid",
  "version_id": "uuid"
}

POST /api/internal/rag/rollback
{
  "agent_id": "uuid"
}

GET /api/internal/rag/runtime-manifest?agent_id={uuid}

Returns the published manifest for a given agent, used by the mobile backend to sync configuration.

POST /api/internal/rag/sync/mobile
{
  "agent_id": "uuid"
}

Triggers a webhook delivery to the mobile NestJS backend with the latest runtime manifest.

The NestJS backend exposes these endpoints for the Flutter mobile app:

Configure webhooks in the agent's settings to receive real-time notifications: