Skip to content
RebelCore Docs

Integration overview

The RebelCore™ API lets an authorised application ask questions against your customer’s semantic specs without using the portal UI. It is intended for server-to-server integrations.

What you can do with it

  • Send a natural-language prompt and one or more spec IDs.
  • Get back a curated answer governed by the project’s LLM exposure level.
  • See every call show up in your customer’s audit panel for review.

What you’ll need before integrating

  1. A trained semantic spec. Build your data in the portal first — import the files, create a project, train the spec. The API only operates on specs that already exist.
  2. An API user. Created by your Customer Super Admin in the portal. See API users for the provisioning flow. The Super Admin walks away with a username and password — give those to your integration.
  3. The API base URL for your deployment. Production is https://api.rebelcore.ai. Use the URL supplied for any separately managed deployment.

How a request flows

your application
   │
   │ 1. POST /api/v1/authorize  (username + password)
   │         ↓
   │    24-hour bearer token
   │
   │ 2. POST /api/v1/infer       (prompt + spec_ids, Authorization: Bearer ...)
   │         ↓
   │    curated answer

Two endpoints, both POST, both JSON in / JSON out. The token from step 1 is reused on every step-2 call until it expires (24 hours), at which point you re-authorise.

Endpoints at a glance

EndpointMethodAuthPurpose
/api/v1/authorizePOSTusername + passwordGet a bearer token
/api/v1/inferPOSTAuthorization: Bearer <token>Run inference

Each endpoint has its own page with the full request/response schema, error codes, and a working example.

Multi-tenancy and data scoping

Every /infer call is scoped to the customer the API user belongs to. A request containing a spec from another customer is rejected.

If your application serves multiple end-customers, each one needs their own API user.

Exposure level — what gets returned

The answer you get back depends on the LLM exposure level configured on the project the spec belongs to:

  • Full — exact values, records, aggregates allowed.
  • Limited — qualitative summaries; exact values masked.
  • Advisory — qualitative business guidance only; no numbers, no records.

The /infer response includes the active exposure as a hint so your application can render the answer appropriately.

Audit

Authorised API calls are available for administrative review. Retain the response correlation identifier so support and your Customer Super Admin can locate the relevant call.

Rate limiting and availability

If the service returns 429 Too Many Requests, wait and retry with exponential backoff.

Do not embed the username, password, or bearer token in browser-facing JavaScript. Treat API-user credentials as service credentials and store them in an approved secret manager.

Next