Finblade API

Everything the Finblade web app does is done through this HTTPS API — the app is just another client. Sign in, hold the access token, and you can chat with the assistant, upload and search documents, build and run workflows, publish apps and dashboards, extract tables and manage your account from any language or tool that speaks HTTP.

Base URL

All paths in this reference are relative to your deployment's API host, written here as https://api.example.com. Your administrator will give you the real host — it is the address the web app talks to, typically https://api.<your-domain> alongside https://app.<your-domain>.

Five-minute start

1. Sign in with your username (or email) and password. The access token comes back in the body; the refresh token is set as a cookie.

curl -s -X POST "https://api.example.com/api/v1/token/login/" \
  -H "Content-Type: application/json" \
  -c cookies.txt \
  -d '{"username": "jane@acme.com", "password": "•••••••••"}'

{ "auth_token": "3f9c1b0e…", "expires_in": 86400, "absolute_expires_in": 7776000 }

2. Call anything with the token in the Authorization header.

export FINBLADE_TOKEN=3f9c1b0e…

curl -s "https://api.example.com/users/me/" \
  -H "Authorization: Token $FINBLADE_TOKEN"

3. Ask the assistant a question.

curl -s -X POST "https://api.example.com/microservices/agent/chat/?timeout=300" \
  -H "Authorization: Token $FINBLADE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"conversation_id": "0f3c9a1e-5d2b-4c7e-8a9f-6b1d2e3f4a5b",
       "message": "What can you help me with?"}'

4. Refresh before the token expires (24 hours) — or just sign in again.

curl -s -X POST "https://api.example.com/api/v1/auth/refresh/" -b cookies.txt -c cookies.txt

Read Authentication for the full session lifecycle and Conventions & errors before building anything serious.

What's in the reference

Section	What it covers	Web app module
Auth & sign-in	Password, passkey and SSO sign-in; registration; verification; passwords	Login, Register, Profile → Security
Users & profile	Your profile, preferences, metadata, linked accounts, organisation directory	Profile
Files & media URLs	Signed URLs for downloading and embedding files	Everywhere files appear
Chat AI	The assistant, conversation threads, message storage, document chat	Chat AI
My Data — documents	Upload, organise, share and search documents; summaries; trash	My Data
My Data — data sources	SharePoint/OneDrive, SQL databases, data-source connections, live feeds, prompt templates	My Data, Connections
Workflow AI	Create, run, schedule, version, tag and share workflows; the tool catalogue	Workflow AI
Workflow assistant	The canvas copilot, skills and long-term memory	Workflow AI, Chat AI
Apps & dashboards	Boards, chart tiles, chart data, dashboard chat, generated files	Apps → Apps, Dashboard
Databases (tables)	Tables extracted from documents, rows, evidence highlights, table databases	Apps → Databases
Studio	Agent-built HTML dashboards, versions, permanent links	Apps → Studio
Connections	External MCP tool servers with OAuth or API keys	Connections
Dedicated Agent	Your own always-on agent: chat, jobs, autonomous runs	Dedicated Agent
Billing & usage	Plans, checkout, invoices, LLM spend	Plans, Profile → Billing/Usage
Webhooks	Trigger workflows from other systems; poll results without a session	Workflow AI → Webhook node
Streaming & WebSockets	Streamed replies, SSE, and the three live channels	—

The same specification is available as an interactive, try-it-out page at OpenAPI, and as a file at /openapi.yaml for import into Postman, Insomnia or code generators.

Versioning and stability

There is one API surface — the one the web app uses — and it evolves with the product. Paths under /api/v1/ (sessions, sign-in, media signing) are the most stable; module paths (/microservices/…, /semantic-search/…) gain fields and endpoints over time but existing fields are not removed without a deprecation note in this reference. Treat unknown fields in responses as ignorable, and unknown fields in requests as rejected or ignored.

Endpoints marked legacy in the reference are kept for older screens and integrations; prefer the alternative named in their description.

Getting help

Response bodies always carry a human-readable detail or error. When you report a problem, include the request path, the status code and that message.