Cortex API

All API requests require an API key passed in the Authorization header. API keys are scoped per organization and prefixed with ctx_.

Authorization: Bearer ctx_your_api_key_here

All endpoints are authenticated and scoped to your organization. Click any endpoint to expand details, view code examples, and send live test requests.

Response Format

All responses are JSON. List endpoints return paginated data. Single-resource and action endpoints return a data object.

{
  "data": [...],
  "pagination": {
    "offset": 0,
    "limit": 50,
    "total": 124
  }
}

{
  "data": {
    "id": "dep_abc123",
    "agent_name": "Support Bot",
    "status": "active",
    ...
  }
}

{
  "error": {
    "code": "not_found",
    "message": "Agent not found.",
    "status": 404
  }
}

Rate Limits

Rate limits are enforced per API key. Every response includes rate limit headers so you can track your usage.

Rate limit headers are included on every response:

X-RateLimit-Limit: 60
X-RateLimit-Remaining: 58
X-RateLimit-Reset: 1709500800

Webhooks

Subscribe to real-time events and receive signed HTTP POST notifications to your endpoint when key actions occur. Manage subscriptions via the Webhooks endpoints in the API.

Event types

Payload shape

Every event is delivered as an HTTP POST with a JSON body:

{
  "event": "agent.status_changed",
  "org_id": "org_jkl012",
  "timestamp": "2025-03-01T10:00:00.000Z",
  "data": { ... }
}

Signature verification

Every delivery includes three headers. Use X-Cortex-Signature to verify the payload was sent by Cortex using the signing secret returned when you created the subscription. The secret is shown only once — store it securely.

X-Cortex-Event: agent.status_changed
X-Cortex-Signature: sha256=<hmac-sha256-hex>
X-Cortex-Timestamp: 2025-03-01T10:00:00.000Z

To verify: compute HMAC-SHA256(secret, rawBody) and compare it to the hex value after sha256= in the header.

// Node.js example
const crypto = require('crypto');

function verify(secret, rawBody, signatureHeader) {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signatureHeader),
  );
}

Example — list agents:

curl https://api.launchcortex.ai/v1/agents \
  -X GET \
  -H "Authorization: Bearer ctx_your_api_key_here"