Call the public API

Use the public API for automation outside the browser. Start with a read operation that cannot change workspace data.

Before you begin

You need a Griot account, an API base URL, and either a session JWT or a personal access token (PAT) issued in workspace settings. A gpat_ PAT has no tenant claim, so you also need your tenant UUID. Store credentials in a secret-aware environment; never paste them into a URL or commit them to a script. gak_ agent keys are for MCP, not these REST calls.

List catalogs

For a PAT, set GRIOT_API_URL, GRIOT_TOKEN, and GRIOT_TENANT_ID in your shell without writing their values into this file. Then request the catalogs visible to that principal:

curl -sS "$GRIOT_API_URL/v1/catalogs" \
  -H "Authorization: Bearer $GRIOT_TOKEN" \
  -H "X-Tenant-Id: $GRIOT_TENANT_ID"

The response should contain an items list of authorized catalogs. A session JWT carries its workspace claim; in that case omit the X-Tenant-Id header. A PAT needs the header for tenant routing, but the server still checks the PAT and its permissions. Neither a header nor a catalog name grants access. A 401/403 is not an empty catalog.

Find the exact operation

Use the generated public API list to find the route and operation ID. Check its OpenAPI schema for required fields before sending a write. There are separate internal and UI-private routes; they are not part of the supported external interface.

The Python SDK and Rust CLI consume this public contract. They are implemented on feature branches but are not yet a published package or binary.