API Overview
High-level overview of OutRiskAI APIs, architecture, authentication mechanisms, and integration routes
OutRiskAI provides programmatic REST APIs designed for both web dashboard interaction and external system integrations.
Looking to integrate OutRiskAI into your CRM or backend pipeline? Jump straight to our Public API Guide or explore the interactive OpenAPI Reference.
API Categories
| API Type | Path Prefix | Authentication | Target Audience |
|---|---|---|---|
| Public REST API | /api/public/v1 | Bearer Token (API Key) | External services, CRMs, mobile apps, CI/CD pipelines |
| Dashboard API | /api/v1 | NextAuth Cookie / Session | OutRiskAI Web Application |
| OpenAPI Spec | /api/public/v1/openapi | Unauthenticated | API client generators, Postman, Fumadocs OpenAPI |
Quick Links & Navigators
Public REST API Guide
Detailed walkthrough on authentication, idempotency, rates, and upload limits.
OpenAPI Reference
Interactive OpenAPI documentation generated directly from live endpoint specifications.
Authentication Setup
Configure NextAuth session authentication and OAuth providers.
Base URLs
Public API (Integrations)
Development: http://localhost:3000/api/public/v1
Production: https://your-domain.com/api/public/v1Dashboard API (Internal Web App)
Development: http://localhost:3000/api/v1
Production: https://your-domain.com/api/v1Authentication Mechanisms
1. API Keys (Public API)
API keys are created from your Profile page under API Credentials (/profile).
Authorization: Bearer ork_live_your_secret_key- Keys support fine-grained scopes (
documents:read,documents:write). - Shared across server instances with rate limiting enforced per key.
2. Session Cookies (Dashboard API)
Requests from the OutRiskAI web app authenticate automatically using HTTP-only encrypted session cookies created via NextAuth.js.
Key Endpoint Summary
Public REST Endpoints (/api/public/v1)
| Method | Endpoint | Description | Scope |
|---|---|---|---|
GET | /health | System health and API version check | Unauthenticated |
GET | /account | Read account metadata for authenticated key | documents:read |
GET | /documents | List uploaded contracts with pagination | documents:read |
POST | /documents | Register contract URL or upload contract file | documents:write |
GET | /documents/{id} | Read metadata for a single contract | documents:read |
DELETE | /documents/{id} | Permanently delete contract and analysis | documents:write |
GET | /documents/{id}/status | Poll asynchronous AI analysis lifecycle | documents:read |
GET | /documents/{id}/analysis | Fetch extracted contract risks & solutions | documents:read |
Response Architecture
All public routes return a uniform JSON envelope structure:
{
"success": true,
"data": { ... },
"error": null,
"meta": {
"pagination": {
"page": 1,
"limit": 20,
"total": 42
}
}
}Rate Limiting & Quotas
- Public API Quota: 100 requests per 15 minutes per API key.
- Headers Included:
X-RateLimit-Limit,X-RateLimit-Remaining,X-RateLimit-Reset. - Exceeded Limit: Returns status
429 Too Many Requestswith aRetry-Afterheader.
Next Steps
- Read the full Public API Integration Guide.
- Test endpoints directly in the OpenAPI Reference.