REST API

Base URL & versioning

All endpoints live under https://api.kijito.ai/api. Every route is also served, with identical behavior, under a version prefix: https://api.kijito.ai/api/v1. Integrations should call the /api/v1 paths - a future breaking change would ship under a new prefix (/api/v2) while /api/v1 keeps its contract.

Changes within a version are additive: new optional fields, new routes, new arguments. A retired route returns 410 Gone naming its replacement. Kijito is currently in public beta (API version 0.1.0); the running version is always available at GET /api/version.

Authentication

Sign in once to get an access token, then send it as a Bearer header on every call. The access token is a JWT valid for one hour; use the longer-lived refresh token to mint a new one.

For unattended or long-running agents, mint a standalone API key: a kjt_-prefixed bearer token, scoped to a least-privilege subset of your own data (memory.read, memory.write, memory.curate, memory.dream) and optionally set to expire. Send it as the Bearer header exactly like an access token - it never needs refreshing. Keys are minted from a full login session (a scoped key cannot mint another), and the secret is shown exactly once at creation.

The same key works as the Bearer header on the MCP server. Interactive clients can use the MCP connector's OAuth sign-in instead (see the Quickstart); because every OAuth refresh rotates the token, several unattended processes sharing one sign-in will invalidate each other's sessions, so give each unattended agent its own key.

# Sign in and capture the access token from the response body.
TOKEN=$(curl -s https://api.kijito.ai/api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email": "[email protected]", "password": "your-password"}' \
  | jq -r .access_token)

The token endpoints:

# Mint a read+write key that expires in 90 days. Save "token" now - it is shown only once.
curl https://api.kijito.ai/api/v1/auth/tokens \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "ci-agent", "scopes": ["memory.read", "memory.write"], "expires_in_days": 90}'
# Then use the returned kjt_ token as the bearer on every call - no refresh needed.

Most write and recall handlers return {"result": <text>} - a rendered, agent-ready summary rather than raw rows. Data endpoints for the web UI (export, stats) return structured JSON.

Memory

curl https://api.kijito.ai/api/v1/remember \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"content": "We chose aqua as the primary accent.", "importance": 0.7}'

curl https://api.kijito.ai/api/v1/recall \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"query": "what did we decide about color?", "limit": 5}'

# Supersede memory 1423 without losing its history.
curl https://api.kijito.ai/api/v1/memory/1423/correct \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"content": "We switched the primary accent from aqua to amber."}'

Goals

Goals are tracked, decay-exempt intentions an agent carries across sessions.

Hive

Durable persona-to-persona messaging within your account. A message is kept after it is read, not consumed.

# river leaves a durable note for the omniview agent.
curl https://api.kijito.ai/api/v1/send \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"to": "omniview", "content": "Deploy is green - pick up the frontend pass."}'

Stats & account

Export

Your data is yours - pull the whole graph out at any time.

curl https://api.kijito.ai/api/v1/export \
  -H "Authorization: Bearer $TOKEN" -o kijito-export.json

Errors

Errors return a JSON body of the shape {error, code} with a matching HTTP status. Treat an unrecognized code as a generic failure for its status. Common ones:

MCP tools

Through an MCP client, each of these endpoints is a tool with the same name - kijito_remember, kijito_recall, kijito_correct, kijito_dream, and so on - dispatched over the same graph with the same per-account isolation. See the Quickstart for connecting a client.