> ## Documentation Index > Fetch the complete documentation index at: https://www.sapientpriors.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Read your key's identity and upload limits > Confirms which organization your key resolves to, and returns the upload limits your organization is held to. Call it once when your client starts, and check a file against the `max_*` values before you send it. ## OpenAPI ````yaml /openapi.yaml get /v1/session openapi: 3.0.3 info: title: Priors API description: > Priors gives you memory agents. An agent learns from the observations you send it and answers from what it learned. You call this API from your own backend with a partner API key. The key identifies your organization, which owns every agent, thread, observation, source, and memory it creates. Another organization receives 404 for those identifiers. Send `X-SP-End-User` alongside the key to act for one named person on your side. version: 0.1.0 servers: - url: https://app.sapientpriors.com/api description: Production security: - partnerKey: [] tags: - name: Agents description: Create, read, update, and delete memory agents. - name: Threads description: 'Conversations under an agent: create them, teach them, and ask them.' - name: Sources description: Files an agent learned from, and the citations that point back to them. - name: Authentication description: What your key resolves to, and the limits that apply to it. - name: Billing description: Your organization's credits and charges. paths: /v1/session: get: tags: - Authentication summary: Read your key's identity and upload limits description: > Confirms which organization your key resolves to, and returns the upload limits your organization is held to. Call it once when your client starts, and check a file against the `max_*` values before you send it. operationId: get_session responses: '200': description: Authenticated application session. content: application/json: schema: $ref: '#/components/schemas/Session' '401': $ref: '#/components/responses/Unauthorized' '503': $ref: '#/components/responses/ServiceUnavailable' components: schemas: Session: type: object required: - authenticated - user - organization_id - organization_name - max_upload_bytes - max_image_bytes - max_images_per_turn - max_image_bytes_per_turn properties: authenticated: type: boolean enum: - true user: $ref: '#/components/schemas/SessionUser' organization_id: type: string nullable: true organization_name: type: string nullable: true max_upload_bytes: type: integer minimum: 1 description: > The largest document your organization may upload, in bytes. A larger upload is refused with 413 before any conversion. max_image_bytes: type: integer minimum: 1 description: > The largest single image, in bytes. Refused with 413 while the body streams. max_images_per_turn: type: integer minimum: 1 description: > How many distinct image sources one chat turn may name. A turn naming more is refused rather than truncated. max_image_bytes_per_turn: type: integer minimum: 1 description: > The total bytes of image one chat turn may carry, across every attachment. Not implied by the two limits above: this is the cap their product would otherwise reach. Always >= max_image_bytes, so a single image at the per-image limit is always sendable. A turn over it is refused with 413 and code payload_too_large. additionalProperties: false description: > What your key resolves to, and the upload limits that apply to it. Read it once when your client starts rather than hardcoding the numbers. SessionUser: type: object required: - id - email - display_name properties: id: type: string email: type: string format: email display_name: type: string additionalProperties: false description: > The principal this request ran as. Without `X-SP-End-User` that is your organization; with it, the derived id for that person. `email` is empty and `display_name` reads `partner key`, because a key names no person. ErrorResponse: type: object required: - error - code - request_id properties: error: type: string code: type: string description: > Machine-readable condition. Branch on this rather than on the status where the two differ. All three of these can arrive as a 5xx and they want different handling: `service_unavailable` (503) is a dependency outage worth retrying, `service_not_configured` (503) is the same transport failure that retrying will NEVER clear because a feature is not switched on for your organization, and `internal_error` (500) is a defect that will fail the same way again. Known values: invalid_request, unauthorized, forbidden, payment_required, not_found, agent_not_found, thread_not_found, conflict, agent_quota_exceeded, duplicate_upload_in_progress, document_already_ingested, document_uploaded_elsewhere, agent_not_ready, payload_too_large, rate_limit_exceeded, service_unavailable, service_not_configured, answer_model_unavailable, internal_error, and the document codes an upload can return (unsupported_document, document_needs_ocr, encrypted_document, malformed_document, empty_document, document_too_large, document_too_complex, document_too_many_turns, document_too_many_pages, document_too_large_for_ocr, document_pages_unexpected, document_service_unavailable, ocr_busy, ocr_failed, ingestion_failed). answer_model_unavailable is a narrower `service_unavailable` (503): the model that writes the visible reply could not be reached after retries. It is worth its own code because it is the one dependency whose outage a caller may want to word differently -- the turn produced no answer at all, and retrying shortly is the right advice. agent_not_found and thread_not_found are narrower `not_found`s, sent so a client can tell WHICH resource vanished and recover accordingly without matching on the English message. Treat any unrecognised value as the status code's default meaning rather than rejecting the response. request_id: type: string description: > Server-issued identifier for this request. Include it when reporting a problem so the call can be correlated with server logs. details: type: string description: | Present on a 429. Names which control refused the request: `user` Your per-subject window, counted against `X-SP-End-User`. `organization` Your organization's ceiling, across every key you hold. `capacity` The service is at capacity. Retry. `ingestion-organization` Too much of your own document work is already running. `ingestion-capacity` As above, service-wide. additionalProperties: false responses: Unauthorized: description: Missing or invalid credentials content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' ServiceUnavailable: description: > A required dependency could not complete the request. Distinct from a 500 by design: the body's `code` is `service_unavailable`, which says the request may succeed on a later attempt, where `internal_error` says it will not. Check the code before retrying. The same 503 carries `service_not_configured` when a feature this route needs is not switched on for your organization. The transport failure is identical and the wait is not: that one answers the same on every attempt until we change the configuration. Contact us. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: partnerKey: type: http scheme: bearer description: > Your API key, shaped `sp__`, sent as `Authorization: Bearer sp_...`. It identifies your organization, not a person. Your organization owns the agents, holds the credit, and is billed. Every key your organization holds reaches the same things, so you rotate a key by minting the new one, deploying it, and revoking the old one. Keep the key on your server. A request that carries a `Sec-Fetch-Site` header is refused with 400, because only a browser sets that header. Priors sends no CORS headers, so a browser blocks the call before it leaves the page. The secret is shown once when the key is minted and is stored only as a hash. A lost secret is replaced, never recovered. An administrator of your organization mints and revokes keys in the Priors application, under Settings. There is no endpoint for it: a key reaches your whole organization, so issuing one is an act of administration. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.