REST API & authentication

datahashi is split into two APIs, at two hosts, with two different credentials.

Control plane — api.datahashi.com

Manages your workspace itself: sign-in, org/workspace membership, connections, semantic models, and API keys. This is what the console talks to, and what you’d script against to automate workspace setup (provisioning a connection or minting a key in CI, say).

The control plane serves its own interactive reference — browse and try every endpoint at api.datahashi.com/docs, backed by the machine-readable spec at api.datahashi.com/openapi.yaml.

Authenticate to the control plane with your normal workspace session (the console handles this) or a control-plane token, depending on which endpoint you’re calling — the Swagger UI above documents each endpoint’s specific requirement.

Endpoints you’ll use most when scripting setup:

Endpoint	What it does
POST /v1/orgs/{orgId}/api-keys	Mint a data-plane API key (mode: governed | explore). Shown once.
GET /v1/orgs/{orgId}/api-keys	List your keys by id/prefix/mode/label — never the secret.
Revoke / rotate a key	Invalidate a leaked key, or replace it without downtime for your other keys.

Data plane — engine.datahashi.com

Where queries actually run. This is the host every guide on this site queries against:

Endpoint	Method	What it does
/v1/query	POST	Run a Semantic Query — see Query the API.
/v1/drill-down	POST	Expand one aggregated cell into its underlying rows.
/v1/models	GET	List your workspace’s semantic model names.
/v1/catalog	GET	One model’s metrics, dimensions, curated views, and (explore mode) measures.
/v1/describe	GET	Look up one metric, dimension, or measure by name.
/mcp	—	The same surface over MCP (Streamable HTTP) — see Use with an LLM agent.

Authenticate with the API key you minted on the control plane, as a bearer token:

Authorization: Bearer <your-api-key>

The key’s claims are identity only — your workspace and mode. The warehouse a query reaches, its row-level security, and its cost limits are all resolved server-side from that identity; there is no field on any data-plane request that can widen them.

Error envelope

Every data-plane error is {"error": {"code", "message"}}, using one of seven stable codes: bad_request, unauthenticated, forbidden, not_found, over_budget, overloaded, internal. See Query the API for the HTTP-status mapping.

A method/path mismatch (calling /v1/query with GET, say) is answered by the router directly — a plain-text 404/405, not this JSON envelope.