Base and authentication
Base URL: https://app.norecord.app. API-key header: Authorization: Bearer $NO_RECORD_API_KEY. Issued keys use the norecord_web_<12-character-prefix>_<43-character-secret> format, and the raw secret is shown once.
Catalog routes
GET /v1/platform— capability registry, including source/release status for web, iOS, desktop, and private economy.GET /v1/privacy/status— current provider-conformance plus D1-marker-scan projection and append-only pass/fail history. The scan covers known No Record D1 tables; it does not cover Durable Object storage, Cloudflare logs, network metadata, or provider storage.GET /v1/models/health— eligible/disabled policy state for every catalog route.GET /v1/models— eligible text routes.GET /v1/images/models— eligible image routes.GET /v1/videos/models— browser-motion routes.
Chat completions
POST /v1/chat/completions
{
"model": "norecord-auto",
"routing": "balanced",
"messages": [{"role":"user","content":"Review this design."}],
"reasoning": "low",
"stream": true
}SSE events: status, route, delta, usage, done, or error. Auto routing strategies are balanced, fast, deep, and economy. Operator-disabled explicit routes fail closed; Auto may choose an eligible health fallback. In-page requests continue when the user switches conversations, but refresh reconnect is not claimed.
Adaptive Loom
POST /v1/loom/runs
{
"prompt": "Review this production migration.",
"policy": "strict",
"models": {"drafter":"norecord-auto","critic":"norecord-deepseek","finalizer":"norecord-coder"}
}Lean uses one call; Balanced uses one or two; Strict uses three; Fixed uses four. The response returns steps, result, aggregate usage, and a content-free receipt.
Image and video
POST /v1/images/generations— model, prompt, variants 1–2, width/height 256–1024, steps 4–20, CFG guidance 1–20; returns base64 JPEG assets.POST /v1/videos/queue— returns an AI keyframe and browser-local render instructions. It does not return provider video or audio.
MCP and connectors
POST /mcp— initialize, resources/list, resources/read, tools/list, and tools/call.GET /skill.md— credential-safe install instructions for compatible MCP agent hosts.ui://norecord/private-workspace.html— MCP App resource with model picker, chat, and image generation through host-proxied tools.POST /v1/connectors/mcp— outbound Streamable HTTP invocation with bounded methods and response size.
Keys, usage, credits, sync
Implemented families: /v1/api-keys, /v1/usage, /v1/credits, and /v1/sync/vaults. Usage includes content-free aggregates and rotating-HMAC active-seat buckets. HTTP 429 responses include Retry-After. GET /v1/payments/packages returns no packages and fundingConfigured: false.