REST API

REST API

Any saved workflow can be published as an HTTP endpoint, and the coordinator's own API is available to scripts.

API keys

Developers → API keys → New. A key is shown once; store it then. Keys are prefixed wt_.

Scopes

Keys are scoped per resource and action. The catalogue is served at GET /api/auth/api-keys/catalog, and the vocabulary is resource:action:

Resource	Actions
workflows	read, write, execute, delete
runs	read
monitors	read, write, execute, delete
datasets	read, delete
crawl	read, execute, delete
scrape	read, execute
files	read, write
personas	read, write, delete
automations	read, write, execute, delete
agents	read
account	read
mcp	execute

A sensible read-only key is workflows:read, runs:read, datasets:read.

For an AI assistant you must include mcp:execute — the MCP endpoint checks for it specifically, and without it every call returns API key is missing the 'mcp:execute' scope.

The route table is fail-closed: a path with no rule is refused rather than waved through, so adding a router cannot silently widen what existing keys can do.

Calling it

curl -s https://writ.example.com/api/automation/workflows \
  -H "Authorization: Bearer wt_..."

Exposing a workflow

Workflow → Connect → Expose as API publishes it at its own endpoint. Callers supply the workflow's {{inputs}} in the request body and get the structured result back.

Freshness is controllable per call:

Parameter	Effect
wait	Block until the run finishes and return the result.
async	Return immediately with a run id to poll.
max_age	Serve the last result if it is younger than this, otherwise re-run.

max_age is the one that saves the most work — a dashboard polling every minute does not need a fresh browser run every minute.

Discovering the surface

/openapi.json, /docs and /redoc are disabled in production, because the schema enumerates every route to anyone who reaches the host and nothing in the product reads it at runtime. Set WRIT_EXPOSE_OPENAPI=true to turn them back on, or read them from a development boot.

Rate limits

RATE_LIMIT_REQUESTS per RATE_LIMIT_WINDOW seconds, per identity. Behind a proxy, set FORWARDED_ALLOW_IPS to your proxy only — with it wide open, any client can spoof X-Forwarded-For and bypass every per-IP control.

Revoking

Developers → API keys → Delete. Revocation is immediate. Usage per key is listed alongside, which is the quickest way to find a key nothing uses any more.