CMD+K API

openapi: 3.1.0
info:
  title: CMD+K API
  version: '2026-10-16'
  description: 'GENERATED FROM DOCUMENTATION by API Evangelist on 2026-10-16: 5 operation(s) read from 3 public documentation page(s) (each operation
    names its page in x-source). This is not the provider''s published contract; CMD+K has published no machine-readable contract that the pipeline
    could find. Engine: local.'
  x-evidence-tiers:
    code-example: 5
    documentation: 0
    pages-with-code: 2
    pages-read: 3
  x-generated-from: documentation
  x-provenance: generated
  x-authored-by: API Evangelist
  x-generated: '2026-10-16'
  x-generator: generate-contract-from-docs.py
  x-engine: local
  x-sources:
  - https://commandplusk.com/docs/monetize/ai-runtime
  - https://commandplusk.com/docs/build-mcp/authentication
  - https://commandplusk.com/docs/widget/partner-embed
paths:
  /api/public/partner/widget/{widgetid}:
    post:
      operationId: post_api_public_partner_widget_widgetid
      tags:
      - Api
      summary: POST /api/public/partner/widget/get
      x-source: https://commandplusk.com/docs/widget/partner-embed
      parameters:
      - name: widgetid
        in: path
        required: true
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostApiPublicPartnerWidgetWidgetidRequest'
      responses:
        '201':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: 'curl -X POST https://commandplusk.com/api/public/partner/widget/get  -H "Content-Type: application/json"  -d ''{"widgetId":"<WIDGET_ID>","mgmtKey":"ck_pmk_..."}'''
        collapsed_from: 3 example path(s) differing only at widgetId
  /api/public/v1/chat/completions:
    post:
      operationId: post_api_public_v1_chat_completions
      tags:
      - Api
      summary: POST /api/public/v1/chat/completions
      x-source: https://commandplusk.com/docs/monetize/ai-runtime
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostApiPublicV1ChatCompletionsRequest'
      responses:
        '201':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: "curl -N https://commandplusk.com/api/public/v1/chat/completions  -H \"Authorization: Bearer ck_pat_...\"  -H \"X-CmdK-End-User:\
          \ user_42\"  -H \"Content-Type: application/json\"  -d '{\n \"model\": \"anthropic/claude-haiku-4-5\",\n \"stream\": true,\n \"messages\"\
          : [{ \"role\": \"user\", \"content\": \"Summarize this ticket…\" }]\n }' Any OpenAI SDK works — set base_url to https://commandplusk.com/api/public/v1\
          \ and add the "
  /api/public/widget/verify:
    post:
      operationId: post_api_public_widget_verify
      tags:
      - Api
      summary: POST /api/public/widget/verify
      x-source: https://commandplusk.com/docs/widget/partner-embed
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostApiPublicWidgetVerifyRequest'
      responses:
        '201':
          description: Success (shape read from the example response on the page)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostApiPublicWidgetVerifyResponse'
      x-evidence:
        kind: code-example
        language: curl
        snippet: 'curl -X POST https://commandplusk.com/api/public/widget/verify  -H "Content-Type: application/json"  -d ''{"widgetId":"<WIDGET_ID>","embedKey":"ck_embed_..."}''
          Responses (always HTTP 200 for a well-formed request): json Copy // success

          { "valid": true, "widget": { "name": "Acme Assistant", "brandingVisible": true } }'
  /cmdk/verify-user:
    post:
      operationId: post_cmdk_verify_user
      tags:
      - Cmdk
      summary: 'Webhook Verify: POST request sent to your endpoint when a user attempts to connect.'
      description: 'The endpoint receives a POST with JSON body containing deployment_slug, subject, email, requested_scopes, client_hint, nonce,
        and timestamp. The request includes headers:

        - `content-type: application/json`

        - `x-cmdk-signature: t=<unix‑ms>,v1=<hex>` (HMAC‑SHA256 of `${timestamp}.${rawBody}` using the shared secret)

        - `x-cmdk-event: mcp_deployment.verify_user`

        - `user-agent: CommandK-MCP-Gateway/1.0`

        Your service must verify the signature, optionally reject stale timestamps, and respond with a 2xx JSON payload. Only the `allowed` field
        is required; other fields are optional.'
      x-source: https://commandplusk.com/docs/build-mcp/authentication
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostCmdkVerifyUserRequest'
      responses:
        '200':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostCmdkVerifyUserResponse'
      x-evidence:
        kind: documentation
  /v1/models:
    get:
      operationId: get_v1_models
      tags:
      - Models
      summary: AI Runtime API — prepaid inference for your own features
      description: Lists the live catalog of available models (Anthropic, OpenAI, Google chat models).
      x-source: https://commandplusk.com/docs/monetize/ai-runtime
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
components:
  schemas:
    PostApiPublicPartnerWidgetWidgetidRequest:
      type: object
      properties:
        widgetId:
          type: string
        mgmtKey:
          type: string
    PostApiPublicV1ChatCompletionsRequest:
      type: object
      properties:
        model:
          type: string
        stream:
          type: boolean
        messages:
          type: array
          items:
            type: object
            properties:
              role:
                type: string
              content:
                type: string
    PostApiPublicWidgetVerifyRequest:
      type: object
      properties:
        widgetId:
          type: string
        embedKey:
          type: string
    PostApiPublicWidgetVerifyResponse:
      type: object
      properties:
        valid:
          type: boolean
        widget:
          type: object
          properties:
            name:
              type: string
            brandingVisible:
              type: boolean
    PostCmdkVerifyUserRequest:
      type: object
      properties:
        deployment_slug:
          type: string
          description: Slug of the MCP deployment.
        subject:
          type: string
          description: User‑provided identifier (or email if left blank).
        email:
          type: string
          description: User’s email address.
        requested_scopes:
          type: array
          description: Array of scopes requested for the token (may be empty).
        client_hint:
          type: string
          description: Short free‑text label of the MCP client, or null.
        nonce:
          type: string
          description: Random 32‑character hex string.
        timestamp:
          type: integer
          description: Unix time in milliseconds; matches the t= value in the signature header.
      required:
      - deployment_slug
      - subject
      - email
      - requested_scopes
      - nonce
      - timestamp
    PostCmdkVerifyUserResponse:
      type: object
      properties:
        allowed:
          type: boolean
          description: Grant (true) or deny (false) the connection. Required.
        subject:
          type: string
          description: Optional replacement for the subject sent in the request.
        email:
          type: string
          description: Optional email to store on the end‑user record.
        display_name:
          type: string
          description: Optional display name for the end‑user.
        scopes:
          type: array
          description: Optional array of scopes to replace the requested_scopes.
        ttl_seconds:
          type: integer
          description: Optional token lifetime in seconds (default 24 h, clamped 60 s–30 days).
        reason:
          type: string
          description: Optional reason shown to the user when allowed is false.
  securitySchemes:
    bearer:
      type: http
      scheme: bearer
security:
- bearer: []
tags:
- name: Api
- name: Cmdk
- name: Models