Skip to main content
All API requests are authenticated with an API key sent in the x-api-key header:

​
API keys

  • Get your API key from the 11x team, or from the platform when invited to your organization.
  • API keys are scoped to your organization and grant access to all of its agents.
  • Store keys securely and never expose them in client-side code.
Requests with a missing or invalid key return 401 with an UNAUTHORIZED or INVALID_API_KEY error code. Requests for an agent that doesn’t belong to your organization return 401/404.

​
Validating your key

To check that your API key works, call a read-only endpoint. Credit usage authenticates the key at the organization level:
To also verify access to a specific agent, list its outcomes:
A 200 from both means your key is valid and the agent is reachable. Both calls are pure reads — they can’t schedule or modify anything, regardless of how they’re invoked.
The scheduling endpoints also respond to HEAD requests for connectivity checks without scheduling.

​
Rate limiting

  • Requests are limited to 10 requests per second per API key.
  • Exceeding the limit returns HTTP 429. Back off and retry with jitter.

​
Error format

All error responses share one shape:
Each endpoint’s reference page lists its specific error codes.