Product API overview

Read and write company memory from another product, such as Burrito AI.

The Product API (/api/v1) is how another product uses Buddhi's memory. A content generator calls it to fetch company context before it writes, so its output reflects what the company actually decided, shipped and sounds like.

Every call goes through the same policy engine and audit log as the dashboard. There is no admin API: a key can do what the person who issued it can do, narrowed to the scopes the key is limited to.

The fastest way in is the drop-in client: one dependency-free file at /sdk/buddhi-client.ts that handles signing, tokens and timeouts. See the Burrito integration guide. The pages below are the reference for what it does underneath.

Base URL

https://<your-buddhi-host>/api/v1

Endpoints

Method	Path	Use it to
`POST`	`/token`	Exchange a strict key for a short-lived access token
`GET`	`/me`	Confirm a key works and see which scopes it reaches
`POST`	`/context`	Get a ready-to-paste block of company context for a prompt
`POST`	`/recall`	Get the individual memories that answer a question
`POST`	`/memories`	Add something to company memory
`GET`	`/facts`	List approved company facts
`GET`	`/facts/:key`	Read one approved fact

Quickstart

Create a key

In Buddhi, open Gateway & Agents and create a key. Choose the surface API (another product) and tick the scopes the product may use. See Authentication. To have customers connect without pasting a key, use Connect a product.

Check the key

curl https://<your-buddhi-host>/api/v1/me \
  -H "Authorization: Bearer crtx_YOUR_KEY"

Fetch context before generating

curl https://<your-buddhi-host>/api/v1/context \
  -H "Authorization: Bearer crtx_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query": "LinkedIn post announcing the export feature, in our brand voice"}'

Put the context in your prompt

Paste the returned context into the generation prompt. If found is false, generate without company facts instead of letting the model invent them.

Conventions

Requests and responses are JSON. Send Content-Type: application/json on every POST.
Timestamps are ISO 8601 in UTC.
Errors always have the shape { "error": { "code", "message" } }. See Errors and limits.
Each key may make 120 requests a minute.
A strict key signs every request and uses short-lived tokens. The examples on these pages show a plain key for brevity; Authentication has the signing recipe.
Send X-Buddhi-End-User with the person who triggered the call, so it shows in the audit trail.

The older /api/recall, /api/memories and /api/facts routes described under Dashboard endpoints serve the dashboard and accept browser sessions. Build integrations against /api/v1: it accepts agent keys only, has a stable response shape, and honours scope-limited keys.