GraphiteGraphite by Augsidius
Using the API

Authentication & keys

Sending your key

Every request needs an API key in the Authorization header:

HTTP
Authorization: Bearer aug_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

x-api-key: aug_live_... is also accepted for clients that cannot set a bearer header.

Never put an API key in a browser, mobile app or any code your users can read. Call the API from your server.

Key types

Prefix Environment Notes
aug_test_ Sandbox Free, low rate limit, fixed evidence snapshot. Available on every plan.
aug_live_ Production Counts toward your plan. Requires a paid plan.

A sandbox key cannot call production projects and vice versa (403 environment_mismatch).

Scopes

Each key has scopes that decide which models and features it can use. Give each key only what it needs.

Scope Grants
agents:care_model aug-care-model and care-model sessions
agents:evidence aug-evidence
agents:differential aug-differential
agents:med_safety aug-med-safety
agents:labs aug-lab-interpret
agents:evidence_qa aug-evidence-qa
agents:scribe aug-scribe
agents:extract aug-extract
agents:coding aug-coding
agents:summary aug-summary
agents:care_plan aug-care-plan
agents:deid aug-deid
agents:interview aug-interview
agents:triage aug-triage
agents:patient_comms aug-patient-explain
cds_hooks Decision cards (aug-cds)
graph:read Read-only concept lookup
feedback:write POST /v1/feedback
usage:read Read this project's usage

Scopes outside your plan are shown greyed out in Graphite and are rejected with 403 scope_not_in_plan.

Creating a key

Graphite → Project → API keys → Create key

  1. Name it after where it will live (e.g. EMR production).
  2. Choose Sandbox or Production.
  3. Tick the scopes it needs.
  4. Optional, under Advanced: an IP allowlist, a per-key rate limit, a monthly unit cap, an expiry date.
  5. Confirm. The full key is shown once. Copy it to your secret manager and click I've saved it.

We never show the full key again; the list shows only aug_live_…abcd.

Rotating a key

Rotate creates a replacement with identical settings. Choose how long the old key keeps working:

  • 24 hours (default) or 7 days — time to deploy the new key everywhere;
  • Revoke now — for a suspected leak.

Revoking a key

Revoke takes effect immediately across all our servers. Requests with a revoked key return 401 invalid_api_key. Revocation cannot be undone.

If a key leaks

  1. Revoke it (or rotate with Revoke now) in Graphite.
  2. Check Logs and Audit log for unexpected use.
  3. Tell us at security@augsidius.com.

Keys use a recognisable prefix so code-hosting secret scanners can detect them. If a leaked key is reported to us, we revoke it and notify your organisation's owners and admins.

Best practices

  • One key per service and environment; never share keys between teams.
  • Use IP allowlists for server-to-server integrations.
  • Set a monthly unit cap on keys used by batch jobs.
  • Rotate production keys at least every 90 days.
  • Store keys only in a secret manager or encrypted environment variables.