openapi: 3.0.3
info:
  title: Cartesia Agents API Keys API
  description: 'The Cartesia REST API for real-time voice AI - text-to-speech and voice-changer generation (single-shot bytes or Server-Sent Events), batch speech-to-text transcription, voice management and cloning, audio infill, custom datasets, pronunciation dictionaries, API keys and scoped access tokens, the Voice Agents platform (agents, calls, call batches, phone numbers, telephony providers, webhooks, deployments, knowledge base documents/folders, and evaluation metrics), and usage reporting. All requests require a `Cartesia-Version` header and an `Authorization: Bearer` API key (`sk_car_...`) or short-lived access token. The lowest-latency, streaming surface for TTS and STT is a separate WebSocket protocol documented in the companion AsyncAPI document at asyncapi/cartesia-ai-asyncapi.yml.'
  version: '2026-03-01'
  contact:
    name: Cartesia
    url: https://cartesia.ai
  license:
    name: API documentation - Cartesia Terms of Service
    url: https://cartesia.ai/terms-of-service
servers:
- url: https://api.cartesia.ai
  description: Cartesia production API
security:
- bearerAuth: []
tags:
- name: API Keys
  description: Standard API key metadata.
paths:
  /api-keys:
    get:
      operationId: listApiKeys
      tags:
      - API Keys
      summary: List API Keys
      description: Returns a paginated list of standard API keys.
      parameters:
      - $ref: '#/components/parameters/CartesiaVersion'
      responses:
        '200':
          description: A page of API keys.
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ApiKey'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /api-keys/{id}:
    get:
      operationId: getApiKey
      tags:
      - API Keys
      summary: Get API Key
      description: Returns metadata for a single API key.
      parameters:
      - $ref: '#/components/parameters/CartesiaVersion'
      - name: id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: The requested API key.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiKey'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
components:
  responses:
    Unauthorized:
      description: Missing, invalid, or expired API key / access token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    NotFound:
      description: The requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  schemas:
    ApiKey:
      type: object
      properties:
        id:
          type: string
        name:
          type: string
        prefix:
          type: string
          description: Redacted prefix of the key, e.g. sk_car_.
        created_at:
          type: string
          format: date-time
        last_used_at:
          type: string
          format: date-time
          nullable: true
    Error:
      type: object
      properties:
        title:
          type: string
        message:
          type: string
        error_code:
          type: string
        status_code:
          type: integer
        doc_url:
          type: string
        request_id:
          type: string
  parameters:
    CartesiaVersion:
      name: Cartesia-Version
      in: header
      required: true
      description: API version date, e.g. 2026-03-01.
      schema:
        type: string
        example: '2026-03-01'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: sk_car_... API key or short-lived access token
      description: 'Cartesia API key (sk_car_...) or a short-lived access token minted via POST /access-token, passed as Authorization: Bearer <token>. Every request also requires the Cartesia-Version header.'