ProductSecurityAPISign in
THE API

The same agent, behind one endpoint.

Everything Xperimeter does in the app it does over HTTP. Send it a sentence; get back what it understood, what it did, and what it will keep watching.

GETTING STARTED
01

Get a key

Create a key in account settings. It's scoped to one household and revocable at any time.

02

Ask in plain language

POST a sentence. No schema to learn, no endpoint per capability.

03

Read what it did

Responses carry the agent's reply plus a structured log of every action it took.

04

Subscribe to changes

Register a webhook and it reaches you the moment something on watch changes.

A FIRST REQUEST

One sentence in. A plan out.

Request
curl https://api.xperimeter.com/v1/conversations \
  -H "Authorization: Bearer $XPERIMETER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "message": "Tell me if the back gate is left open after dark."
  }'
Response
{
  "id": "conv_7fa21c",
  "reply": "I'll watch the back gate from sunset to
            sunrise and message you if it's open
            more than two minutes.",
  "actions": [
    {
      "type": "watch.created",
      "id": "wat_39b0",
      "subject": "back gate",
      "window": "sunset-sunrise"
    }
  ]
}
REFERENCE

Six endpoints, and that's the whole surface.

POST/v1/conversations

Open a conversation with the agent, or continue one by passing its id.

GET/v1/conversations/:id

Fetch a conversation with its full message and action history.

GET/v1/watches

List everything the agent is currently keeping an eye on.

DELETE/v1/watches/:id

Stand down a watch. It stops immediately and says so in the log.

GET/v1/events

Page through observations and alerts, newest first.

POST/v1/webhooks

Register a URL to receive events as they happen, signed with your key.

QUESTIONS

Frequently asked

Do I need to learn a schema?

No. Every capability is reachable through one conversational endpoint — the agent decides which tools to use. The structured endpoints exist for listing and teardown, not for driving it.

How is access scoped?

A key belongs to one household and inherits the boundaries you've already set in plain language. A key can't reach a sensor you've muted, or a room you've told the agent to leave alone.

Are responses streamed?

Yes. Pass Accept: text/event-stream and the reply arrives token by token, with actions emitted as they're taken rather than at the end.

What are the rate limits?

60 requests per minute per key, and 10 concurrent streams. Webhook deliveries retry with backoff for 24 hours before they're dropped.