Documentation

The Rofiant API is a REST API served over HTTPS. Requests and responses use JSON. The API is reachable at https://api.rofiant.ca, or as /api/v1/* on rofiant.ca directly.

1. Create an API key

Sign in and go to Dashboard → API Keys to generate a key. API access requires a Pro, Team, Agency, or Enterpriseplan — keys cannot be created on the Free plan. The key is shown once, in full, at creation time; only its prefix is stored and shown afterward.

2. Make a request

curl https://api.rofiant.ca/v1/chat/completions \
  -H "Authorization: Bearer $ROFIANT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "messages": [
      { "role": "user", "content": "Summarize this quarter'\''s incident reports." }
    ]
  }'

Every request is authenticated with a bearer token in the Authorization header. Keys are prefixed sk_; requests without a valid key return 401.

Authorization: Bearer sk_...

Each request updates the key's last_used_at timestamp, visible on the API Keys page. Keys can be revoked at any time from the dashboard.

POST /v1/chat/completions— generate a chat response, in an OpenAI-compatible request/response shape.

Request body

Non-streaming response

{
  "id": "chatcmpl-...",
  "object": "chat.completion",
  "created": 1730000000,
  "model": "llama-3.3-70b-versatile",
  "choices": [
    {
      "index": 0,
      "message": { "role": "assistant", "content": "..." },
      "finish_reason": "stop"
    }
  ],
  "usage": {
    "prompt_tokens": 42,
    "completion_tokens": 128,
    "total_tokens": 170
  }
}

Streaming

Set stream: true to receive text/event-stream server-sent events. Each event is a chat.completion.chunk object with adelta.content string; the stream ends with a final chunk (finish_reason: "stop") followed by a literal data: [DONE] line.

GET /v1/models — list available models.

Either the alias or the canonical name may be passed as model in a chat completion request.

GET /v1/usage?days=30— token and request counts for the authenticated key's account, grouped by model. days is optional (default 30, max 90).

{
  "object": "usage",
  "period_days": 30,
  "total_requests": 214,
  "by_model": {
    "llama-3.3-70b-versatile": {
      "requests": 180,
      "input_tokens": 52340,
      "output_tokens": 98120
    }
  }
}

GET /v1/audit/logs?limit=50— recent audit events for the account (API key creation, webhook changes, etc). limit is optional (default 50, max 200).

{
  "object": "list",
  "data": [
    {
      "id": "...",
      "action": "api_key.created",
      "detail": { "name": "prod-key", "keyId": "..." },
      "ip": "203.0.113.10",
      "created_at": "2026-06-30T18:12:00.000Z"
    }
  ]
}

Register an https:// endpoint from Dashboard → API Keys → Webhooks and select which events to receive:

• document.processed — a document finished processing
• voice.processed — a voice recording finished processing

Each delivery is a POST with a JSON body of { event, created, data } and an X-Rofiant-Signatureheader: an HMAC-SHA256 hex digest of the raw body, signed with the webhook's secret (shown once, at creation, prefixed whsec_). Verify it before trusting the payload.

Agency and Enterprise plans can provision users from an identity provider (e.g. Okta, Azure AD) via SCIM 2.0 at /v1/scim/v2/Users.

• GET /v1/scim/v2/Users — list agency members as SCIM User resources
• POST /v1/scim/v2/Users — provision a new member

Authenticate with the agency's SCIM token (Dashboard → Agency → SCIM) as a bearer token — this is a separate credential from a regular API key.

Errors return a non-2xx status with a JSON body:

{
  "error": {
    "message": "Invalid or missing API key",
    "type": "api_error",
    "code": 401
  }
}

Rate limits

/v1/* endpoints are limited to 60 requests per 60 seconds per API key. A 429 response includes a Retry-After header with the number of seconds to wait.