POST /v1/sites/{siteId}/ide-assist

Authentication

This endpoint is public. It takes no credential and no organisation — it is what our own marketing site and AI answer engines read.

This endpoint takes no organisation id. Your key already identifies the organisation it belongs to, and the response is scoped to it.

Try it

Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.

curl -X POST https://api.zinndigital.com/v1/sites/{siteId}/ide-assist \
  -H "Content-Type: application/json" \
  -d '{ "context": <string> }'

Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console

Details

Answers one request about one file, from inside the site's browser editor, and bills the model call to that site's organisation on the same AI meter as every other surface (their own provider key if they have added one, their Zinn® credit if not). **This is the one site endpoint family with no user session behind it, and that is deliberate.** Its caller is a VS Code extension running inside the customer's own CageFS jail on a hosting box, which cannot hold a Keycloak session. It authenticates with a **signed, site-bound, expiring grant** minted when the editor is opened and presented as `Authorization: Bearer <grant>`. The grant names the site, the organisation and the person who opened the editor; the site in it must match the site in the path, and the organisation is read from the grant and never from the request body, so a grant for one site can neither ask about another nor bill another tenant. The grant never reaches the customer's browser: it is held in a root-owned file on the hosting box and attached by the editor gate, which runs outside every jail. A missing or unreadable grant is a `404`, never a `401`, so this cannot be used to discover that a site exists. An **editing** action (`fix`, `refactor`, `complete`, `generate`) returns a `proposal`: the complete replacement for the region that was sent. It is a suggestion and nothing on this side applies it — the editor shows it as a diff and writes it only after the customer approves. A **read-only** action (`ask`, `explain`) never returns one, however code-shaped its answer. A refusal the customer should read — an exhausted allowance, a revoked provider key, a question that is too long, a file too large to rewrite safely — is a `422` carrying the sentence to show them and a code in `details[].code`, because "you are out of credit" and "we could not reach the model" are different facts and only one of them is theirs to fix.

Parameters

Request body

Response

Errors this endpoint can return

404 · 422 · 429