# API overview

> Automate PentAGI over REST and GraphQL — create a Bearer token, start flows from CI/CD, pull results into your own tools and generate a client.

Most of what you can do in the web UI is available through the API — start [flows](https://pentagi.com/docs/glossary/#flow) from CI/CD, pull results into your own tools or build integrations.

| API     | Endpoint          | Interactive docs             |
| ------- | ----------------- | ---------------------------- |
| GraphQL | `/api/v1/graphql` | `/api/v1/graphql/playground` |
| REST    | `/api/v1/...`     | `/api/v1/swagger/index.html` |

## [Create a token](https://pentagi.com/docs/api/overview/#create-a-token)

1. Open **Settings → API Tokens** in the web UI.
2. Click **Create Token**, optionally name it and set an expiration between 1 minute and 3 years.
3. Copy the token right away — it is shown only once.

A token belongs to your account and inherits your role's permissions. Users, roles and API tokens, flow [templates](https://pentagi.com/docs/glossary/#template), favorites and your settings are managed only from a signed-in browser session: a token gets 403 on the REST `/users`, `/roles` and `/tokens` routes and an error from those GraphQL operations.

## [Call the API](https://pentagi.com/docs/api/overview/#call-the-api)

```bash
curl -X POST https://your-pentagi-host:8443/api/v1/graphql \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"query": "{ flows { id title status } }"}'

curl https://your-pentagi-host:8443/api/v1/flows/ \
  -H "Authorization: Bearer YOUR_API_TOKEN"
```

Start a flow with a GraphQL mutation:

```graphql
mutation CreateFlow {
  createFlow(modelProvider: "openai", input: "Test the security of https://example.com") {
    id
    title
    status
    createdAt
  }
}
```

## [Generate a client](https://pentagi.com/docs/api/overview/#generate-a-client)

* **GraphQL** — the schema is `backend/pkg/graph/schema.graphqls` in the repository; use GraphQL Code Generator, genqlient or Apollo.
* **REST** — the OpenAPI spec is served at `/api/v1/swagger/doc.json`:

```bash
openapi-generator-cli generate \
  -i https://your-pentagi-host:8443/api/v1/swagger/doc.json \
  -g python \
  -o ./pentagi-client
```