DigitGPTAuthentication & Application API
Authenticated Workspace EndpointsDigitGPT Studio uses authenticated workspace endpoints secured by Firebase ID tokens and organization membership checks. Server routes issue short-lived session tokens so upstream credentials are never exposed in the browser.
Workspace authentication and session tokens
Client requests authenticate with a Firebase ID token in the Authorization header and target a specific workspace via the x-avamai-organization-id header. The server validates workspace membership and role permissions before minting a short-lived conversation session token.
const idToken = await user.getIdToken();
const response = await fetch("/api/studio/session-token", {
method: "POST",
headers: {
"Content-Type": "application/json",
Authorization: `Bearer ${idToken}`,
"x-avamai-organization-id": organizationId,
},
body: JSON.stringify({ humanId }),
});
const data = await response.json();
if (!response.ok) throw new Error(data.error || "Session unavailable");
// data.sessionToken is a short-lived client session token.Application route contracts
| Route | Purpose & parameters |
|---|---|
| GET /api/studio/catalog?kind=avatars|voices|llms | Retrieve the studio catalog of permitted avatars, voices and language models. |
| POST /api/studio/session-token | Load a saved assistant by { humanId }, attach its authorized knowledge scope and mint a short-lived session token. |
| GET /api/studio/knowledge?groupId=… | List workspace knowledge groups or the indexed documents inside a specific group. |
| POST /api/studio/knowledge | Upload documents (multipart groupId + file) or run website page discovery and import (analyze-site, import-selected, search). |
| /api/studio/preview-sessions | Track session lifecycle, heartbeats and workspace conversation usage. |
| POST /api/studio/avatar-videos | Submit an idempotent scripted video render job for { contentId } within workspace quota. |
Session lifecycle and status codes
The shipped DigitGPT inline and embed players automatically handle session initialization, media streaming, heartbeats, quota enforcement and clean teardown.
The session-token endpoint returns 403 for unauthorized workspace access, 400 for invalid parameters, 402 when monthly quota is exhausted, 404 when the assistant is not found, 409 for knowledge scope conflicts and 502 if upstream media initialization fails.