Get Hosted API
Retrieve one hosted API.
Dark launch: requires the hosted_apis_access entitlement (402 hosted_apis_not_in_plan otherwise).
Authentication
Enter your API key with the Bearer prefix, e.g. ‘Bearer sk_…’.
Path parameters
Hosted API id (prefixed external id, api_...).
Headers
Response headers
Response
The public host, <slug>.<hosted-api domain>; empty where no domain is configured.
The API’s display name; the server title an MCP client shows when mcp_enabled is on.
What the API is for. When mcp_enabled is on it is also the
instructions an MCP client hands its model, so say what the tools
are for and when to use them.
Who the API answers, narrowest first. owner: only the API’s owner,
with their own Speechify API key or console session. workspace:
any member of the owning workspace, the same way. user_token:
every request presents a short-lived JWT your backend signed for the
calling user (sub, exp within 24 hours, optional aud naming
this API), verified against the API’s signing secret (HS256) or its
registered JWKS URL (RS256 / ES256 / EdDSA). consumer_key: every
request presents a ck_ bearer minted for this API. public: no
credential; only read resolvers may be served, the per-IP limiter is
the only bound, and a workspace can refuse it as policy
(hosted_apis_public_allowed). The three modes that name a person
(owner, workspace, user_token) let routes bind {{user.sub}},
key the response cache per person, and stamp a written document as
that person’s.
Browser origins allowed to call the API (* for any). Empty for server-to-server only.
Runs the API’s run routes may start per UTC day; the spend ceiling behind a leaked consumer key.
The key set end-user tokens are verified against when set (an
https URL on a public host, read on demand and cached briefly).
When null, tokens are verified against the API’s signing secret.
The masked signing secret end-user tokens are verified against (the rotate-user-token-secret verb mints it); null until minted.
Reads the API’s store, file, run_latest and tool routes may serve
per UTC day; the ceiling behind a hot path, and for a tool route
behind the vendor budget its calls draw on. Always present on a
current API; optional on the wire so a reader built
before it existed keeps parsing. A
response served from the cache is not a read. Past the cap a read
route answers 429 route_read_limit_reached. Without Redis nothing
counts: a public route is paused by the limiter in that state, a
keyed or tokened caller passes.
Documents the API’s write routes may land per UTC day; the storage
ceiling behind a leaked key on a write route. Past the cap a write
route answers 429 route_write_limit_reached. Optional on the wire
for the same reason as daily_read_cap.
Whether the API also serves its routes as an MCP server at
POST <base_url>/mcp (streamable HTTP, stateless, POST only): every
enabled route except a file route is listed as a tool, named by the
route’s name and described by its description, and a call runs
under the same audience, consumer keys, per-key limits, daily caps
and request log the route has. An MCP client authenticates with the
same bearer a plain consumer sends (a ck_ consumer key, an
end-user token, or a Speechify API key on a workspace or owner
API); the API’s OpenAPI document names the address under
x-speechify-mcp.url. Off for a new API, where /mcp answers 404
hosted_mcp_not_enabled; never true on a public API (refused
with 400 on either switch). Optional on the wire for the same
reason as daily_read_cap.
The address an MCP client attaches to, <base_url>/mcp, while
mcp_enabled is on; null while it is off. Read it here rather
than assembling it.