API Center

Pick an endpoint from the public REST API definition, fill parameters, send a same-origin request and inspect the response.

Generated from the public API definitions

Version v1.0.0 · Updated 2026-10-28 · revision 1

The API Center turns the generated OpenAPI interface definitions into a working console: pick an endpoint, fill parameters, send a real request and inspect the status, headers, body and equivalent curl. It never re-declares an API table — the endpoint catalogue always comes from the interface definitions read at build time.

What it does#

• Endpoint selector grouped by tag, covering the platform REST surface and the Interactive Whiteboard REST surface.
• Path and query parameter inputs generated from the interface definition, with required fields marked.
• Request body field templates generated from the schema, editable as raw JSON.
• Two authentication modes: project credentials (Basic) or a whiteboard room/project token.
• Response pane with status code, response headers, formatted body and the equivalent curl.

Credentials and security#

• Credentials are kept only in this tab's sessionStorage and are cleared when the tab closes; they are never written to server storage, logs or cookies.
• The documentation site exposes a same-origin proxy at /api-proxy, so the browser never calls the control plane cross-origin; the proxy does not log Authorization / token headers and persists nothing.
• A production deployment must allow /api-proxy/ in the documentation site's reverse proxy (see the deployment guide); otherwise the console reports a network error.
• Low-privilege tokens are useful for debugging too: a reader token calling a write endpoint returns 403, which is expected.

HTTP status vs error code#

Branch on code; use status only for coarse routing. The 401/403 split matters most (since round 9):

Three practical rules:

1. The same 403 can mean "your role lacks the permission" or "the service is not enabled"; the message to the user is different, so read code.
2. Treat a session as dead only when status === 401 and code is an authentication code; treating 403 as "logged out" kicks users who merely lack a permission.
3. "No permission" is details.permissionDenied === true; there is no permission_denied error code. The full catalogue lives in the error-code reference.

How to use it#

1. Create a project in the console and copy customerId / customerSecret, or mint a room token on the server first.
2. Pick an endpoint and fill in the path and query parameters.
3. Edit the request body JSON when needed.
4. Click “Send request” and inspect the result on the right; the curl preview reproduces the call in a terminal.

Limitations#

• The proxy only forwards /v1, /dev/v1, /v2 and /console prefixes; every other path is rejected.
• Browser calls are subject to same-origin policy and CORS; the proxy is the only supported path.
• The console keeps no request history; use the example scripts or the SDK for regression runs.

No request sent yet.