Nora REST API overview and base URLs
A complete reference for the Nora REST API: base URLs, authentication, rate limiting, content type, health check, and public config endpoints.The Nora REST API is a JSON-over-HTTP interface that lets you deploy agents, manage LLM providers, configure channels, and observe platform health programmatically. Every request must be authenticated — with either a session JWT or a workspace API key — except for the public health, config, and webhook endpoints listed below. All request and response bodies use
application/json.
Base URL
The Nora API is served under the/api path of your Nora origin. In local mode this is:
http://localhost:8080 with your origin — for example:
All paths in this reference omit the
/api prefix for brevity. When making real requests, include
/api — for example http://localhost:8080/api/agents.Authentication
Protected endpoints accept either of two credentials. 1. A session JWT — supplied as a Bearer token:POST /auth/login. Tokens are valid for 7 days and are also accepted as an HttpOnly session cookie. See the Authentication page for the full login flow.
2. A workspace API key — supplied as a Bearer token (the key begins with nora_) or in the X-Api-Key header (alias X-Nora-Api-Key):
Session-authenticated requests skip scope checks (role-based guards apply instead). A request whose API key lacks the required scope is rejected with
403 and { "code": "missing_scope" }.
Explicit Authorization, X-Api-Key, and X-Nora-Api-Key credentials take precedence over the
ambient session cookie. Nora rejects conflicting explicit credentials with 400 and { "code": "conflicting_auth" } instead of silently selecting the more privileged identity.
Agent scopes are also workspace-bound: an API key can list or address only agents assigned to the
workspace where the key was issued, even when its issuing user owns or can access agents elsewhere.
Non-Remote agents created through deploy, adopt, or duplicate are atomically assigned to that
workspace before queue or runtime work begins.
The issuing user must remain an active user and a member or owner of the bound workspace. Removing
that issuer makes the key unusable; issue a replacement from another workspace admin instead of
allowing a retained credential to impersonate a deleted or removed account.
Some operations are session-only and reject API keys even with a valid scope — including demo
activation, migration-draft deployment, Remote Docker placement and existing-agent operations,
user-global LLM-provider credentials, platform-wide performance monitoring, workspace writes, and
API-key issuance. These return
403 with { "code": "session_required" }. Workspace monitoring
and cost reads remain available with their documented scopes, but are restricted to the key’s
exact bound workspace.Rate limiting
Two rate-limit tiers apply to every request:
When you exceed a limit the API returns
429 Too Many Requests with:
Content type
All request bodies must be sent as JSON. Set the header on every mutating request:Public endpoints
These endpoints do not require authentication.Health check
{"status":"ok"} after the server has finished its startup sequence, including database migrations and catalog seeding. The API does not bind its HTTP listener until that sequence succeeds.
Platform config
string
Platform mode. One of
selfhosted or paas.object | null
Resource limits when
mode is not paas, otherwise null.boolean
Whether Stripe billing is active.
object
Whether the exact
openclaw + local docker + standard runtime tuple required by one-click
demo activation is enabled. Includes the tuple, requiresLiveDocker: true, and a public issue
when unavailable. The mutation still checks the Docker daemon live before queueing work.NemoClaw config
boolean
Whether the NemoClaw sandbox is enabled on this server.
string
Default NVIDIA model identifier.
string
OCI image used for NemoClaw sandboxes.
string[]
List of supported NVIDIA model identifiers.