API reference
The AY-Robots REST API lives under https://www.ay-robots.com/api and speaks JSON in both directions. This page documents authentication, the response conventions, and every endpoint, with full parameter documentation for the routes you are most likely to call programmatically.
Last updated 2026-08-09
Authentication
Every endpoint requires authentication unless it is listed in the Public section. The API accepts two forms of credentials, and both arrive the same way: either as the session cookie the dashboard already sends, or as an Authorization header with a Bearer token.
| Method | How it works | Use it for |
|---|---|---|
| Browser session | The Supabase session token of your logged-in account, sent as a cookie or as a Bearer token | The dashboard itself and quick experiments from an authenticated browser context |
| API key | A key with the prefix ayr_live_, created in /dashboard/settings and sent as a Bearer token | Scripts, servers, CI, and anything that must not depend on a browser login |
| MCP | The hosted MCP server at https://www.ay-robots.com/api/mcp (Streamable HTTP) | LLM agents and tools that speak the Model Context Protocol |
curl https://www.ay-robots.com/api/sessions \
-H 'Authorization: Bearer ayr_live_your_key_here'API keys are created and revoked in /dashboard/settings. Treat them like passwords: keep them server-side, and rotate by creating a replacement key before revoking the old one. If you use the desktop CLI, it can also expose the platform as a local MCP server with the command: ay-robots mcp.
Responses are JSON. Errors use a consistent shape: a JSON object with a single error field containing a human-readable message, delivered with an appropriate 4xx or 5xx status code. Success responses return the resource directly; a few endpoints wrap lists in a named field, which the examples below show where it matters.
Auth endpoints
Account and profile plumbing. These are primarily used by the dashboard itself, but they work with any valid credential.
/api/auth/profileBearer session token or API keyReturns the profile of the authenticated user.
/api/auth/profileBearer session token or API keyUpdates profile fields such as the display name and notification preferences.
/api/auth/syncBearer session tokenSynchronizes the Supabase auth user with the platform user record.
/api/auth/check-onboardingBearer session tokenReports whether the authenticated user has completed onboarding.
/api/auth/avatarBearer session tokenUploads a new avatar image for the authenticated user.
Client endpoints
Everything a robot owner manages: registered robots, the client profile, datasets, invoices, and dashboard statistics.
/api/client/robotsBearer session token or API key (client role)Lists the robots registered by the authenticated client, newest first, up to 50 entries. Timestamps are ISO 8601; last_online and last_heartbeat are null until the robot has connected once.
curl https://www.ay-robots.com/api/client/robots \
-H 'Authorization: Bearer ayr_live_your_key_here'[
{
"id": "1f9f4c1e-7f2a-4b7e-9a45-0f4d2b6c8a11",
"name": "Lab SO-100",
"robot_type": "SO-100",
"status": "AVAILABLE",
"control_url": "wss://robots.example.com/so100/control",
"stream_url": "https://robots.example.com/so100/stream",
"hardware_id": "board:local:usb-1",
"last_online": "2026-08-09T10:12:00.000Z",
"last_heartbeat": "2026-08-09T10:12:00.000Z",
"total_hours": 12.5,
"tags": ["lab"],
"notes": null,
"created_at": "2026-07-01T09:00:00.000Z"
}
]/api/client/robotsBearer session token or API key (client role)Registers a new robot and returns its id. A motor board hardware id can belong to only one robot; a collision is rejected with status 409.
/api/client/profileBearer session token or API key (client role)Returns the client profile of the authenticated user.
/api/client/profileBearer session token or API key (client role)Updates client profile fields.
/api/client/datasetsBearer session token or API key (client role)Lists the client's cloud datasets with episode counts and sizes.
/api/client/invoicesBearer session token or API key (client role)Lists the client's monthly invoices.
/api/client/statsBearer session token or API key (client role)Returns usage statistics for the client dashboard.
Operator endpoints
The operator side: profile and availability, certifications, scheduling, and earnings statistics.
/api/operator/profileBearer session token or API key (operator role)Returns the operator profile of the authenticated user.
/api/operator/profileBearer session token or API key (operator role)Creates or updates the operator profile.
/api/operator/available-robotsBearer session token or API key (operator role)Lists robots that are currently available and match the operator's certifications.
/api/operator/certificationsBearer session token or API key (operator role)Lists the operator's certification requests and their status.
/api/operator/certificationsBearer session token or API key (operator role)Requests certification for a robot type.
/api/operator/scheduleBearer session token or API key (operator role)Returns the operator's weekly availability schedule.
/api/operator/scheduleBearer session token or API key (operator role)Updates the weekly availability schedule.
/api/operator/availabilityBearer session token or API key (operator role)Returns the operator's current availability.
/api/operator/statsBearer session token or API key (operator role)Returns earnings and session statistics for the operator dashboard.
Sessions
Sessions are the core resource of the platform: one session is one continuous teleoperation engagement between an operator and a robot. Session status moves through PENDING, ACTIVE, PAUSED, COMPLETED, and CANCELLED.
/api/sessionsBearer session token or API keyLists sessions for the authenticated user. Operators see sessions they operated; clients see sessions on their robots. The field set differs slightly between the two views: the client view includes episodes_collected and data_collected_mb, the operator view includes operator_earnings_cents.
| Name | In | Type | Description |
|---|---|---|---|
| status | query | string | Optional. Filter by session status, for example ACTIVE or COMPLETED. Omit to list all. |
| limit | query | number | Optional. Page size, default 50, maximum 100. |
| offset | query | number | Optional. Pagination offset, default 0. |
curl 'https://www.ay-robots.com/api/sessions?status=COMPLETED&limit=10' \
-H 'Authorization: Bearer ayr_live_your_key_here'{
"sessions": [
{
"id": "6b0d2c9a-53f1-4f6e-8f1a-2c9d4e7b5a30",
"status": "COMPLETED",
"started_at": "2026-08-08T14:00:12.000Z",
"ended_at": "2026-08-08T14:47:31.000Z",
"duration_minutes": 47,
"client_charge_cents": 1175,
"episodes_collected": 23,
"data_collected_mb": 210.4,
"rating": 5,
"created_at": "2026-08-08T13:59:58.000Z",
"robot_id": "1f9f4c1e-7f2a-4b7e-9a45-0f4d2b6c8a11",
"robot_name": "Lab SO-100",
"robot_type": "SO-100",
"operator_name": "Jane D."
}
]
}/api/sessionsBearer session token or API key (operator role)Starts a teleoperation session on an available robot. Requires the operator role: clients cannot start sessions. An operator can hold at most one ACTIVE or PAUSED session at a time, and the robot must currently have status AVAILABLE. On an immediate start the robot switches to IN_SESSION and the client is notified.
| Name | In | Type | Description |
|---|---|---|---|
| robotId | body | string | Required. Id of the robot to operate. The robot must be AVAILABLE. |
| operatorId | body | string | Optional. Explicit operator id; defaults to the authenticated operator. |
| scheduledFor | body | string (ISO 8601) | Optional. Schedules the session for a future time instead of starting it immediately. |
curl -X POST https://www.ay-robots.com/api/sessions \
-H 'Authorization: Bearer ayr_live_your_key_here' \
-H 'Content-Type: application/json' \
-d '{"robotId": "1f9f4c1e-7f2a-4b7e-9a45-0f4d2b6c8a11"}'{
"sessionId": "6b0d2c9a-53f1-4f6e-8f1a-2c9d4e7b5a30",
"status": "ACTIVE"
}/api/sessions/[id]Bearer session token or API keyReturns a single session with its details.
/api/sessions/[id]Bearer session token or API keyUpdates the session lifecycle: pause, resume, end, and related actions.
/api/sessions/[id]/extendBearer session token or API key (client, session owner)Requests a session extension. Only the client who owns the session can call this, and the session must be ACTIVE. The request is logged as a session event and the operator receives a notification; the extension itself happens when the operator acts on it.
| Name | In | Type | Description |
|---|---|---|---|
| id | path | string | The session id. |
| additionalMinutes | body | number | Requested extension length in minutes. |
curl -X POST https://www.ay-robots.com/api/sessions/6b0d2c9a-53f1-4f6e-8f1a-2c9d4e7b5a30/extend \
-H 'Authorization: Bearer ayr_live_your_key_here' \
-H 'Content-Type: application/json' \
-d '{"additionalMinutes": 30}'{
"message": "Extension request sent to operator"
}/api/sessions/[id]/messagesBearer session token or API keyLists the chat messages of a session.
/api/sessions/[id]/messagesBearer session token or API keySends a chat message in a session.
/api/sessions/[id]/rateBearer session token or API key (client)Rates a completed session on a 1 to 5 star scale, with an optional comment.
/api/sessions/exportBearer session token or API keyExports session data.
Payments
All money movement runs through Stripe. Client billing uses a Stripe customer with a saved payment method; operator payouts use Stripe Connect. The platform itself never stores card or bank data.
/api/stripe/customerBearer session token (client role)Creates or returns the Stripe customer used for client billing.
/api/stripe/connectBearer session token (operator role)Returns the status of the operator's Stripe Connect account.
/api/stripe/connectBearer session token (operator role)Starts Stripe Connect onboarding for operator payouts.
/api/stripe/setup-intentBearer session token (client role)Creates a Stripe SetupIntent for saving a payment method.
/api/stripe/portalBearer session token (client role)Creates a Stripe billing portal session for managing payment methods and invoices.
/api/stripe/payoutBearer session token (operator role)Returns payout information for the authenticated operator.
/api/stripe/payoutBearer session token (operator role)Requests a payout of accumulated earnings. The minimum payout is 10.00 EUR.
/api/stripe/webhookStripe webhook signatureReceives Stripe webhook events. Called by Stripe, not by API clients.
Public endpoints
These endpoints require no authentication. They are safe to call from monitoring, marketing pages, or a status probe.
/api/healthHealth check for the API and its database connection. Returns 200 when both are fine; if the database check fails, the same shape is returned with status and db set to error and HTTP status 503.
curl https://www.ay-robots.com/api/health{
"status": "ok",
"db": "ok",
"timestamp": "2026-08-09T10:12:00.000Z"
}/api/robots/[id]Returns public information about a supported robot model.
/api/public/pricingReturns the current public pricing plans.
/api/contactSubmits a contact form message. The message is stored first and then delivered by email, so a temporary mail outage does not lose it: in that case the response reports stored true and delivered false, and delivery is retried operationally.
| Name | In | Type | Description |
|---|---|---|---|
| name | body | string | Required. Your name. |
| body | string | Required. A valid email address for the reply. | |
| category | body | string | Required. One of: General Inquiry, Bug Report, Feature Request, Sales & Pricing, Partnership, Career/Jobs, Technical Support, Billing & Payments, Press & Media, Other. |
| subject | body | string | Required. Short subject line. |
| message | body | string | Required. The message body. |
curl -X POST https://www.ay-robots.com/api/contact \
-H 'Content-Type: application/json' \
-d '{
"name": "Jane Doe",
"email": "jane@example.com",
"category": "Technical Support",
"subject": "SO-100 pairing question",
"message": "My arm shows as offline after pairing."
}'{
"success": true,
"message": "Message sent successfully",
"id": "b1f2c3d4-0000-0000-0000-000000000000",
"stored": true,
"delivered": true
}/api/robot-requestRequests support for a robot type that is not yet on the platform.
/api/statsReturns public platform statistics.
How AY-Robots secures accounts and live robot control: Supabase authentication, role model, API keys, session safeguards, audit trail, and encryption.
How AY-Robots sessions work: the PENDING to COMPLETED lifecycle, every activity event explained, session chat, ratings, extensions, and training data.