API overview
This reference covers only what an outside developer can call today. Most of the platform talks to itself over private endpoints that are not listed here, and they will refuse your requests. If something is not on these pages, it is not a public API yet.
What is open
| API | Host | Credential | Status |
|---|---|---|---|
| Sign-in with Syndicate | auth.aperturesyndicate.com | OAuth client from Dev Studio | Open to developers |
| ASAI inference | asai.aperturesyndicate.com | asai_… key | Paid |
| Resonance catalogue | resonance-api.aperturesyndicate.com | none | Open, personal and non-commercial |
| Apeiron game server | apeiron.aperturesyndicate.com | ags_… game key | Open to published games |
| SYNX registry | synx.aperturesyndicate.com | none to read, CLI session to publish | Open |
| Status | status.aperturesyndicate.com | none | Open |
Webhooks, pay-as-you-go billing outside ASAI, and public APIs for chat, profiles or datasets do not exist.
Getting access
Everything that needs a credential starts in Dev Studio. It runs on your normal Syndicate account.
- Request developer access at dev.aperturesyndicate.com/apply. The Developer badge is granted the moment you submit; we review afterwards and can revoke it.
- Sign-in apps — register an OAuth client, get its
client_id. - Wallet and ASAI keys — fund a wallet folder and issue an
asai_…key that pays from it. - Apps & games → your game → Items — issue
ags_…keys for your game server.
If the Developer badge is revoked, your keys are revoked with it.
Requests and responses
- HTTPS only, JSON bodies with
content-type: application/jsonunless a page says otherwise. - Times are ISO 8601 in UTC; durations carry their unit in the name (
durationMs). - ids are UUIDs unless a page says otherwise. A game's id is its
pb_…product id. - Lists take
limitandoffsetand return the page with a totalcount.
Errors
Most APIs answer an error with a JSON body carrying a human message and a stable machine code:
{ "error": "Unknown client", "code": "INVALID_CLIENT" }Branch on code, never on the message text. ASAI is the exception: it answers in the OpenAI shape so existing SDKs understand it — see ASAI inference.
| Status | Means |
|---|---|
400 | The request is malformed or names something that does not exist |
401 | Missing, wrong or revoked credential |
402 | The wallet folder behind an ASAI key is empty |
403 | The credential is valid but does not allow this |
404 | Not found — also returned for things that exist but are not yours |
409 | A rule refused the action (limits, duplicates, review state) |
429 | Rate limit — slow down and retry later |
5xx | Our fault; retry with backoff |
Rate limits
| API | Limit |
|---|---|
Sign-in /authorize | 30 per minute per IP |
Sign-in /token | 60 per minute per IP |
| ASAI | 60 requests per minute per key |
| Resonance catalogue | 300 requests per minute per IP |
A limited request gets 429. Back off; retrying in a tight loop only keeps you limited.
Stability
A documented field is not removed or renamed without notice on this page. New fields may appear in any response at any time — ignore what you do not recognise. Undocumented fields can change without warning.
Rules
Using the API means accepting the Developer & API Terms. The Resonance catalogue also falls under Resonance Terms of Service, Section 8, which is stricter: no commercial use without asking, attribution is mandatory, and removed tracks must disappear from your app within seven days.
Found a vulnerability? See Responsible Disclosure.