> ## Documentation Index
> Fetch the complete documentation index at: https://how.to.usegolem.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# API Overview

> Base URL, authentication, and response conventions for the Golem AI API

# API Overview

The Golem AI REST API gives you programmatic access to apps, audits, findings, reports, and the CVE catalog. All endpoints return JSON.

## Base URL

```text theme={null}
https://api.usegolem.ai
```

## Authentication

Every request must include a Bearer token:

```bash theme={null}
curl -H "Authorization: Bearer $GOLEM_API_KEY" \
  https://api.usegolem.ai/api/apps
```

Generate a key from **Profile** in the dashboard. Keys look like `golem_sk_...` and are shown only once at creation. See [Profile & API Keys](/profile).

## Response envelope

Every response follows the same shape:

```json theme={null}
{
  "success": true,
  "data": { ... },
  "error": { "message": "..." }
}
```

On failure, `success` is `false` and `error.message` explains what went wrong. Typical status codes: `400` for invalid input, `401` for missing or invalid credentials, `404` for resources outside your account, `429` when rate-limited.

## Core resources

| Resource    | Endpoints                                               | Docs                                          |
| ----------- | ------------------------------------------------------- | --------------------------------------------- |
| Apps        | `GET/POST /api/apps`, `GET/PATCH/DELETE /api/apps/{id}` | [Apps API](/api/apps)                         |
| App drafts  | `GET/POST /api/app-drafts`, verify flow                 | [Apps API](/api/apps)                         |
| Audits      | `GET/POST /api/apps/{id}/audits`, report retrieval      | [Audits API](/api/audits)                     |
| Mobile      | prescan, binary upload, store search                    | [Mobile API](/api/mobile)                     |
| CVE catalog | `GET /api/cves`, per-app scoping                        | [CVEs & Subdomains](/api/cves-and-subdomains) |
| Subdomains  | `POST /api/subdomains`, run status                      | [CVEs & Subdomains](/api/cves-and-subdomains) |

## Rate limits

Sensitive endpoints are rate-limited (see [Limits](/billing/limits)). Back off exponentially on `429` responses.

## Conventions

* Lists are paginated with `page` and `limit` query parameters (default limit 20, max 100)
* Domains are normalized automatically — `https://www.acme.example.com/` becomes `acme.example.com`
* Targets outside the app's verified domain scope are rejected
* Deleting anything is a soft delete; history is preserved