API overview

llms.txt Ask agent

# API overview

Source: https://docs.originalpictures.com/api/overview/
Full index for AI agents: https://docs.originalpictures.com/llms.txt

## Base URL

```text
https://dev-api.originalpictures.com
```

This is the development environment and currently the only deployed API origin. All operations
are versioned under `/v1/`. Operational probes (`/healthz`, `/readyz`) sit at the root.

## Requests and responses

Requests and responses are JSON unless an operation says otherwise. Media bytes never travel
through the API itself: the API issues short-lived URLs for direct upload and download (see
[Sign](/api/sign/)). Responses never include storage bucket names, object keys, or storage
version identifiers.

## Authentication

Send an API key as a bearer token:

```text
Authorization: Bearer opk_<lookup>.<secret>
```

Each key carries scopes, and every operation requires one. See
[Authentication](/api/authentication/).

## Idempotency

Operations that create durable work require an `Idempotency-Key` header. Examples are
`POST /v1/sign`, `POST /v1/uploads/{upload_id}/complete`, `POST /v1/verifications`, and
`POST /v1/webhook-endpoints`. Generate a fresh value for each logical request and reuse it only
when you retry that request. If you reuse a key with a different payload, you get a conflict error
such as `JOB_IDEMPOTENCY_CONFLICT`.

## Asynchronous work

Signing and verification are durable jobs. The create call returns `202 Accepted` with a
snapshot. Poll the job until it reaches a terminal state. A client timeout does not cancel the job.
See [Asynchronous contracts](/api/async-contracts/).

## Errors

Error responses carry a stable `code`, a `message`, a `request_id`, a `retryable` flag, and a
`documentation_url`. See [Errors](/api/errors/).

## Versioning

Breaking changes will not be made within `/v1/`. The full contract is the
[API reference](/api/), generated from the same OpenAPI document the server is checked against.

Base URL

https://dev-api.originalpictures.com

This is the development environment and currently the only deployed API origin. All operations are versioned under /v1/. Operational probes (/healthz, /readyz) sit at the root.

Requests and responses

Requests and responses are JSON unless an operation says otherwise. Media bytes never travel through the API itself: the API issues short-lived URLs for direct upload and download (see Sign). Responses never include storage bucket names, object keys, or storage version identifiers.

Authentication

Send an API key as a bearer token:

Authorization: Bearer opk_<lookup>.<secret>

Each key carries scopes, and every operation requires one. See Authentication.

Idempotency

Operations that create durable work require an Idempotency-Key header. Examples are POST /v1/sign, POST /v1/uploads/{upload_id}/complete, POST /v1/verifications, and POST /v1/webhook-endpoints. Generate a fresh value for each logical request and reuse it only when you retry that request. If you reuse a key with a different payload, you get a conflict error such as JOB_IDEMPOTENCY_CONFLICT.

Asynchronous work

Signing and verification are durable jobs. The create call returns 202 Accepted with a snapshot. Poll the job until it reaches a terminal state. A client timeout does not cancel the job. See Asynchronous contracts.

Errors

Error responses carry a stable code, a message, a request_id, a retryable flag, and a documentation_url. See Errors.

Versioning

Breaking changes will not be made within /v1/. The full contract is the API reference, generated from the same OpenAPI document the server is checked against.