API reference / Overview
API reference
Use the hosted API to manage your resources and connect real-time avatar experiences. Each endpoint documents its path, accepted credential and response format.
Base URL
https://zeli-avatar.zelibot.xyzAppend the endpoint path exactly as documented. Paths include /api/, /auth/ and /v1/; do not add an extra prefix.
Live streaming requires an available avatar service. Account management, saved Personas, provider settings and token creation can be used independently of an active stream.
Authentication
| Use case | Credential |
|---|---|
| Backend SDK and supported management operations | API key in X-Api-Key |
| Browser SDK streaming | Short-lived session token minted by your backend |
| Account, API-key and Persona owner management | Signed-in portal account |
| Public Persona visitors | Share-link consent and scoped visitor session flow |
Each endpoint states its accepted credential. API keys do not grant access to all account routes, and streaming tokens cannot perform management operations.
Never include a full API key in browser code. Mint a short-lived token with POST /v1/streaming.create_token and pass only that token to the browser.
See Authentication to create a key and implement token minting.
Field names and envelopes
Request and response bodies are JSON. Field names are snake_case
throughout: expires_at, next_cursor, avatar_id, source_kind,
idle_stand_in, emotion_responsive, transcript_unavailable.
The one exception is the SDK control WebSocket, which is camelCase
(sessionId, correlationId, contentIndex, endOfSpeech). It sits on the
same host as the snake_case HTTP routes. See
Events and models.
Most routes return a bare object, not a wrapper. Three routes wrap their
payload in data, and they are named where they appear:
POST /v1/streaming.create_token, POST /v1/photo_avatar.create and
POST /api/chat/reset.
Errors
Response shapes vary by endpoint; the endpoint reference documents the exact shape.
Structured, used by every /auth/* route and by the streaming and media routes
(clips, photo avatar, settings refusals, token minting):
{ "error": { "code": "avatar_not_found", "message": "No such avatar." } }POST /v1/streaming.create_token returns the same two fields unwrapped:
{ "code": "mint_failed", "message": "..." }Flat, used by some media routes:
{ "error": "only uploaded avatars can be deleted" }The code is the stable, machine readable half; branch on it rather than on the
message, which is written for a person and may be reworded.
Status codes
| Code | Meaning in this API |
|---|---|
200 | Successful read, write, stop or delete that returns a body |
201 | Created: an API key, a consent attestation, a publication attestation, a portrait |
202 | Accepted, work queued: a clip generation, an avatar erasure |
400 | Invalid body, unknown tone, a setting this deployment refuses, a cursor that is not yours |
401 | missing_api_key, invalid_api_key, or insufficient_scope for a session token on a full route |
403 | consent_required on a clip generation |
404 | Not found, or not yours. The two are deliberately the same answer |
409 | Already in progress: a clip for that tone is already generating |
501 | feature_disabled: photo avatar creation or clip generation is off on this avatar server |
502 | An upstream model, voice engine or store failed |
503 | A subsystem is not configured or not available in this environment |
A resource that exists but belongs to somebody else answers 404,
never 403. A 403 would confirm the id exists, which
turns a read into a probe for other developers' resources. Treat
404 as "no such resource of yours".
Pagination
Read the pagination fields documented for each endpoint. Session history uses limit and an opaque cursor, returning next when another page exists. Persona lists, versions, links and visitor sessions have their own paginated responses. Do not decode or construct cursors, and do not assume every catalogue is paginated.
Groups
Mint a token, check readiness, drive and stop the live session, read and erase conversation history.
WebRTC signalling, service health and session transport.
Named drafts, published versions and visitor sessions.
Create, list, inspect, publish and erase avatars.
Emotion tone clips as asynchronous jobs. No script to MP4 rendering.
The caller's voice catalogue, cloning, previews, and the provider key vault.
The model catalogue, with residency and selectability flags.
Not served. What to use instead.
Tools run inside a turn. No REST surface.
Share published Personas and manage website embeds.
Not served.
Create, list and revoke the credentials every route above needs.