AVTR Public API v1

Canonical V0 public API for AVTR. Six endpoints only — legacy/bridge routes (/start, /status, /ws-token, DELETE /v1/sessions/{id}, /sfu/*, catalog/system routes) are deliberately absent from this spec even though the deployed Worker still serves them.

All /v1/* routes require an API key (Bearer or x-api-key). Responses use the flat AVTR error taxonomy body ({code, message, request_id, doc_url, retry_after?}) for every 4xx/5xx.

Provider credentials are per-session ephemeral and held in Gateway process memory ONLY for the session lifetime; never persisted. provider_connection_id is rejected at the schema level. Managed provider connections are deferred to a post-V0 optional mode.

API Keys

API key management endpoints.

• POST
  Create an API key/v1/api-keys
• DELETE
  Revoke an API key/v1/api-keys/{key_id}

Sessions

Session lifecycle endpoints.

• POST
  Create AND start a session/v1/sessions
• GET
  Get session status/v1/sessions/{session_id}
• POST
  Mint a fresh short-lived client token (canonical V0)/v1/sessions/{session_id}/client-token
• POST
  End session (canonical V0)/v1/sessions/{session_id}/end