> ## Documentation Index
> Fetch the complete documentation index at: https://docs.outkit.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# API Overview

> Direct HTTP integration for custom applications and AI pipelines

The Outkit REST API lets you enhance AI text responses from any language, framework, or backend. Send raw text in, get structured UI components back.

## Base URL

```
https://api.outkit.dev
```

## Authentication

All endpoints require an API key passed in the `x-outkit-api-key` header:

```bash theme={null}
curl https://api.outkit.dev/components \
  -H "x-outkit-api-key: your-api-key"
```

The fastest way to create one is the [CLI](/docs/cli/keys):

```bash theme={null}
npm install -g @outkit-dev/cli@latest
outkit login
outkit keys create -n "dev"
```

The plaintext key is shown exactly once. You can also create keys from
[app.outkit.dev](https://app.outkit.dev).

<Warning>
  Never expose your API key in client-side code. Call the Outkit API from your backend and forward results to your frontend.
</Warning>

## Endpoints

| Method | Path                                   | Description                       | Auth     |
| ------ | -------------------------------------- | --------------------------------- | -------- |
| `POST` | [`/render/enhance`](/docs/api/enhance) | Transform text into UI components | Required |
| `GET`  | [`/components`](/docs/api/components)  | List available component types    | Required |

## Response Format

All endpoints return JSON. Successful responses return `200`. Errors return structured JSON with an `error` and `detail` field:

```json theme={null}
{
  "error": "InputTooLargeError",
  "detail": "Content exceeds maximum allowed size"
}
```

### Error Codes

| Status | Error                    | Meaning                                |
| ------ | ------------------------ | -------------------------------------- |
| `400`  | BadRequest               | Invalid or missing request parameters  |
| `401`  | Unauthorized             | Missing or invalid API key             |
| `403`  | Forbidden                | API key is revoked or team is inactive |
| `413`  | InputTooLargeError       | Content exceeds 512 KB                 |
| `422`  | ValidationError          | Request body failed schema validation  |
| `429`  | RateLimitExceeded        | Too many requests — slow down          |
| `500`  | InternalError            | Unexpected server error                |
| `502`  | ProviderError            | LLM processing failed                  |
| `503`  | ProviderUnavailableError | LLM provider temporarily unavailable   |
| `504`  | ProviderTimeoutError     | LLM processing timed out               |

## Rate Limits

Rate limits depend on your plan:

| Plan | Requests per minute | Max components per response |
| ---- | ------------------- | --------------------------- |
| Free | 10                  | 5                           |
| Pro  | 100                 | 8                           |

<Note>
  Additional plans with higher limits are available. See [outkit.dev](https://outkit.dev) for details.
</Note>

When rate limited, you'll receive a `429` response. Implement exponential backoff in your client.

### Rate Limit Headers

Every response includes rate limit headers:

| Header                  | Description                                               |
| ----------------------- | --------------------------------------------------------- |
| `X-RateLimit-Limit`     | Maximum requests per minute for your plan                 |
| `X-RateLimit-Remaining` | Requests remaining in the current window                  |
| `X-RateLimit-Reset`     | Unix epoch timestamp when the window resets               |
| `Retry-After`           | Seconds to wait before retrying (only on `429` responses) |

## Content Limits

* Maximum request body size: **512 KB**
* Requests exceeding this limit receive a `413` response

## CORS

The API accepts requests from any origin (`Access-Control-Allow-Origin: *`), but you should still route requests through your own backend to protect your API key.