Skip to main content

Prompt Hub API

Vault API

Rule Engine API

Manage Models API

Scanner API

API Keys API

​
Product surfaces

In addition to the SDK-facing endpoints above, the OpenLIT client ships an interactive OpenAPI reference at Settings → OpenAPI Spec (/openapi-spec). That catalog also covers:
  • AI Analysis — GET/POST /api/chat/improvement/{spanId} for saved runs and streaming reviews of traces/spans
  • Ask Otter — /api/chat/* for config, conversations, streaming messages, SQL execute, widgets, and usage
  • Telemetry — logs, metrics, traces, exceptions, and span hierarchy APIs
  • Scanner — POST /api/scanners/{id}/scan, GET /api/scanners, and GET /api/scanners/findings for Trustabl jobs and findings
See AI Analysis, Chat with Otter, and Scanner connectors for product docs.

​
Request context headers

OpenLIT scopes data by Organisation → Project → Environment. Signal routing (latest) picks the connector for each signal from the active project + environment.

​
Non-SDK APIs (telemetry, Ask Otter, AI Analysis, Scanner, …)

Use signal routing headers only. Do not send x-openlit-database-config-id. The API key still binds a vault/credential database config (middleware injects x-database-config-id).

​
SDK-facing APIs (Prompt Hub, Vault, Rule Engine)

Prefer signal routing (project + environment) to resolve the intelligence ClickHouse that stores prompts, secrets, and rules. Existing SDKs that only send Authorization: Bearer … keep working via the API key’s bound database config. Those endpoints also accept an explicit x-openlit-database-config-id when it belongs to the same project as the key.

​
Authentication

All documented endpoints require an Authorization header:
Manage Models UI pages also accept a signed-in OpenLIT session in the browser. The public pricing export requires no auth.

​
API key access

Create and manage keys under Settings → API Keys. Each key shows its access in the Access column.
  • Community edition: every API key has full access to every endpoint that accepts API keys.
  • OpenLIT Enterprise: with role-based access control, a key can be restricted to specific features when it’s created, or later with Edit access. A restricted key gets a 403 (This API key does not have access to this feature) on endpoints outside its features, and OTLP ingestion needs the Telemetry ingestion feature.
Use Create API Key and Update API Key Access to manage access programmatically. API key management (/api/api-key) requires a signed-in session, so an API key can’t list, create, change, or delete keys, including its own.