Developer docs — not the OpenAI Codex coding tool
One REST API for support
and compliance.
Tickets, knowledge base, FAQs, AI triage, and compliance-document generation — behind one base URL and one API key. No SDK required; any language that can send an HTTP request can call it.
The OpenAPI 3.1 document is public and needs no key — import it into Postman, Insomnia, or your editor before you sign up.
Authentication
One base URL. One header.
Every application endpoint lives under https://api.codextitan.com/api/v1 and is authenticated with an API key you generate in the dashboard.
The X-CT-API-Key header
Send your key on every request. A request without it is rejected with 401 MISSING_API_KEY. Keys are scoped to a single workspace and carry per-key permissions, so a key issued for one product can never read another’s data.
Keys are server-side credentials
Keep API keys on your backend. For browser and mobile surfaces use the embeddable widget or the hosted portal instead — both authenticate without exposing a key in client code.
Two endpoints need no key at all
GET /api/v1/health and GET /api/v1/plans are public. Call them to confirm connectivity and read live plan limits before you have an account.
Endpoints
What the API covers.
The API-key surface, grouped by what it does. The OpenAPI specification is the authoritative, always-current reference — this table is an orientation map, not a substitute for it.
| Path | What it does |
|---|---|
| /api/v1/tickets | Create and update support tickets and their threaded messages. |
| /api/v1/kb | Read and manage knowledge base articles. AI triage answers from these. |
| /api/v1/faqs | Read and manage FAQs surfaced in the widget, portal, and AI answers. |
| /api/v1/feedback | Submit NPS, CSAT, and general product feedback. |
| /api/v1/bugs | File and track bug reports from inside your product. |
| /api/v1/features | Feature requests, including votes. |
| /api/v1/canned-responses | Reusable reply templates for agents and automation. |
| /api/v1/users | Identify your end users so their tickets and history stay linked. |
| /api/v1/docs | Source documents the AI reads when drafting content and answers. |
| /api/v1/legal | Fetch your published legal documents to embed in your own app. |
| /api/v1/consent-log | Record cookie-consent events for your compliance audit trail. |
| /api/v1/sub-processors | Maintain the sub-processor registry your privacy policy is generated from. |
| /api/v1/webhooks | Subscribe to events and receive them at your own endpoint. |
| /api/v1/credits | Read your AI credit balance and consumption. |
Compliance-document generation, DSAR handling, billing, and team management are dashboard-authenticated rather than API-key endpoints. See the Compliance API page for what those cover.
Conventions
Predictable across every endpoint.
The same error envelope, the same rate-limit behaviour, and the same key everywhere — so your client code has one path to handle, not one per resource.
One error shape
Every failure returns an error object with a machine-readable code, a human message, and the HTTP status. Branch on the code, not the prose.
Structured error envelope
Rate limits you can back off from
Requests are rate-limited per plan. Exceeding the limit returns 429 with a Retry-After header, so a retry loop has a number to wait on rather than a guess.
429 + Retry-After
A spec, not just prose
The public OpenAPI 3.1 document describes every endpoint, request body, and response. It is generated from the running service, so it does not drift from the API.
OpenAPI 3.1, no key required
Three ways in.
Pick the surface that matches where your users are. They share one workspace and one dataset.
REST API
Call the endpoints directly from your backend with an X-CT-API-Key header. Full control, any language, no client library to keep current.
Embeddable widget
One script tag drops a support surface into your web app — no API key in client code. This marketing site runs it; the launcher in the corner is the same widget you would embed.
Hosted portal
A branded support site at your own subdomain with your knowledge base, FAQs, ticket submission, and data-request form — no frontend work at all.
Reference
Where the details live.
This page orients you. These are the surfaces that carry the specifics.
OpenAPI 3.1 specification
The complete machine-readable contract for every endpoint. Public, unauthenticated, and importable into Postman, Insomnia, or an editor that reads OpenAPI. Start here if you want to explore before signing up.
Interactive API reference — sign-in required
A browsable reference inside the dashboard, filtered to the permissions on your own API key, with request samples you can run against your workspace. You need an account to open it — the Free plan is enough and takes no card.
Compliance API
Privacy policy, cookie policy, terms, and DPA generation, cookie consent, and DSAR intake — what the compliance half of the platform does and how it fits alongside support.
Support portal
Our own knowledge base, running on Codex Titan. Ask an integration question here — and see what your users’ portal would look like while you do.
Get a key and make the first call.
Sign up, generate an API key, and POST your first ticket. No credit card, and the Free plan does not expire.