API Reference
Base URL: https://api.gwc-corp.com
Authentication
Pass your API key in the Authorization header as a Bearer token. Generate your key in the GWC dashboard under Settings → API Keys.
curl https://api.gwc-corp.com/api/tasks \ -H "Authorization: Bearer YOUR_API_KEY"
Example: create a task
curl -X POST https://api.gwc-corp.com/api/tasks \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"name": "Generate report",
"agent": "my-agent",
"input": "Analyze Q2 sales data"
}'More Examples
List tasks with filters
Use query parameters to filter and paginate your task list. Pass offset to fetch subsequent pages.
curl "https://api.gwc-corp.com/api/tasks?status=RUNNING&limit=10" \ -H "Authorization: Bearer YOUR_API_KEY"
Get a single task
Fetch a specific task by its ID to check status or retrieve results.
curl https://api.gwc-corp.com/api/tasks/clx1y2z3a0000qzrm5f8h2j9k \ -H "Authorization: Bearer YOUR_API_KEY"
Update a task
Patch a task to update its status, output, or other fields.
curl -X PATCH https://api.gwc-corp.com/api/tasks/clx1y2z3a0000qzrm5f8h2j9k \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"status": "COMPLETED",
"output": "Q2 sales up 12% year-over-year"
}'Check credit balance
Query your current credit balance and usage.
curl https://api.gwc-corp.com/api/credits/balance \ -H "Authorization: Bearer YOUR_API_KEY"
Create a subscription
Subscribe to a paid tier. Add "seats" for corporate (no minimum) or enterprise (min 100 seats). Returns a Stripe Checkout URL — redirect the user to complete payment.
curl -X POST https://api.gwc-corp.com/api/subscriptions/subscribe \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"plan": "standard"
}'Tasks
/api/tasksCreate a new task./api/tasksList tasks. Supports ?status=RUNNING&limit=50&offset=0./api/tasks/:idGet a single task by ID./api/tasks/:idUpdate a task (status, output, actions)./api/tasks/:id/approveApprove a task./api/tasks/:id/rejectReject a task awaiting approval. Optional { reason }./api/tasks/:id/retryRetry a failed task./api/tasks/:id/reviewGet the review state of a task.Agents
/api/agentsList registered agents./api/agents/departmentsList agent departments./api/agents/catalogBrowse the agent catalog.MCP Servers
/api/mcpList connected MCP servers./api/mcpConnect a new MCP server./api/mcp/:id/pingHealth-check a connected MCP server./api/mcp/:id/toolsList the tools a connected MCP server exposes./api/mcp/:id/invokeInvoke a tool on a connected MCP server./api/mcp/:idDisconnect an MCP server.Credits & Billing
/api/credits/balanceGet current usage and balance./api/credits/topupCreate a top-up checkout session (Stripe)./api/subscriptionsGet current subscription tier./api/subscriptions/subscribeSubscribe or change tier./api/subscriptions/cancelCancel subscription./api/subscriptions/resumeResume cancelled subscription.Auth
/api/auth/sessionExchange Firebase ID token for a GWC session./api/auth/logoutEnd the current session./api/auth/refreshRefresh session token.Request & Response Schemas
Tasks
Task object
id string — Unique task identifier, e.g. clx1y2z3a0000qzrm5f8h2j9k.name string — Human-readable task name.assignedAgent string — Agent assigned to this task (POST accepts agent as an alias).status string — One of: PENDING, RUNNING, COMPLETED, FAILED, CANCELLED, WAITING_APPROVAL. Defaults to PENDING.input string — Task input (max 50,000 chars).output string | null — Task output once completed (max 50,000 chars).createdAt string (ISO 8601) — Creation timestamp.updatedAt string (ISO 8601) — Last update timestamp.{ task }; list responses as { tasks, total }.POST /api/tasks — Request body
name required stringagent string — Agent name from the catalog (alias for assignedAgent).input string — Task input (max 50,000 chars).status string — Uppercase enum (see Task object). Defaults to PENDING.projectId string — Project to attach the task to.description string — Longer task description.priority number — 0–10, default 0.parentTaskId string — Parent task ID (for subtasks).output string — Initial output, if any.actions string[] — Action log entries stored in task metadata.PATCH /api/tasks/:id — Request body
name string — New task name.description string — New description.priority number — 0–10.status string — New task status (uppercase enum).output string — Updated task output (max 50,000 chars).logs string — Log lines appended to the task’s existing output.actions string[] — Appended to the task’s action log.CANCELLED; to re-run a failed task use POST /api/tasks/:id/retry.Agents
Agent object
name string — Unique agent identifier.displayName string — Display name.description string — What the agent does.department string — Department the agent belongs to.tier number — Internal agent hierarchy: 1 = Director, 2 = Lead, 3 = Specialist.tags string[] — Tags describing agent capabilities.premium boolean — Whether this is a premium agent.requiredTier string — Minimum subscription tier required (e.g. STANDARD, ADVANCED).locked boolean — Whether the agent is locked for your subscription tier.model string — Model backing this agent. On GET /api/agents it is included only for Advanced, Corporate, and Enterprise accounts; GET /api/agents/:name and GET /api/agents/resolve always include it.GET /api/agents — Query parameters
department string — Filter by department name.tier number — Include only agents at or below this hierarchy tier (1–3).search string — Full-text search across name, description, and tags.page integer — Page number, 1-indexed (default 1).limit integer — Items per page (default 50, max 200).{ agents, departments, total, page, limit }.Credits & Billing
GET /api/credits/balance — Response
topUpCents integer — Top-up balance in cents (excludes allowance).totalAvailable integer — Total available in cents (allowance + top-up, minus reserved).totalLoadedCents integer — Lifetime amount loaded, in cents.totalSpentCents integer — Lifetime spend, in cents.hasAllowance boolean — Whether a monthly allowance is active.allowOverflow boolean — Whether spend overflows to top-up balance when the allowance is depleted.usageBar object — Allowance usage: used / total / remaining (cents), percent, status (normal | warning | depleted), resetsAt (ISO 8601).balance object — availableUsd / totalLoadedUsd / totalSpentUsd (USD strings), availableCents / reservedCents (integers).POST /api/credits/topup — Request body
amountCents required integer — Top-up amount in cents, min 500 ($5), max 100000 ($1,000).{ checkoutUrl, amount } — checkoutUrl is the Stripe Checkout Session URL (redirect the user to complete payment); amount echoes the requested amountCents (in cents, not USD).GET /api/subscriptions — Response
{ subscription, effectiveTier, userTier } — subscription may be null if none exists.subscription.tier string — One of: BASIC, STANDARD, ADVANCED, CORPORATE, ENTERPRISE.subscription.status string — One of: ACTIVE, CANCELLED, PAST_DUE, TRIALING.subscription.currentPeriodEnd string (ISO 8601) — When the current billing period ends. Also: cancelAtPeriodEnd (boolean), downgradeTarget (string | null).GET /api/credits/balance.Auth
POST /api/auth/session — Request body
idToken required string — Firebase ID token from your auth provider.{ token } — a JWT valid for 7 days. Use it as the Bearer token on subsequent requests. Decode the JWT to read the expiry (exp claim).POST /api/auth/refresh — Response
{ token } — a new JWT valid for 7 days. The old token is accepted even if expired, as long as its signature is valid; requests with a missing or invalid-signature token are rejected (401), and tokens whose account no longer exists are rejected (404).Error Codes
The API uses standard HTTP status codes. Error responses are wrapped in an envelope: { error: { message, code?, details?, timestamp, path } }. The code field is optional — many errors (e.g. most 401s) carry no code, so key off the HTTP status first and treat error.code as a hint.
| Status | Code | Meaning |
|---|---|---|
| 400 | VALIDATION_ERROR | The request body is malformed or missing required fields. |
| 401 | AUTHENTICATION_ERROR | Missing or invalid Authorization header. Often returned with no code field. |
| 402 | STRIPE_ERROR | A payment processing error occurred. |
| 403 | AUTHORIZATION_ERROR | Your tier or role does not permit this operation. |
| 404 | NOT_FOUND | The requested resource does not exist. |
| 409 | CONFLICT | The request conflicts with the current state (e.g. resource already exists). |
| 429 | RATE_LIMITED / RATE_LIMIT_EXCEEDED | Too many requests — see Rate Limiting below. Rate-limiter 429 bodies contain only { error: { message, code } } (no timestamp/path). |
| 500 | INTERNAL_SERVER_ERROR / DATABASE_ERROR | An unexpected server error occurred. Retry with exponential backoff. |
Example error response:
{
"error": {
"message": "Task not found",
"code": "NOT_FOUND",
"timestamp": "2026-07-05T12:00:00.000Z",
"path": "/api/tasks/clx1y2z3a0000qzrm5f8h2j9k"
}
}For 429 responses, retry timing comes from the Retry-After and RateLimit-Reset headers, not the response body.
Rate Limiting
Rate limits are applied per user account, not per API key — every key you mint draws on the same bucket, so adding keys does not add headroom. Unauthenticated requests are keyed by client IP instead. Limits vary by subscription tier.
Each tier has a single enforced ceiling: the number of requests allowed in a rolling 60-second window. There is no separate “burst” allowance on top of it — the ceiling below is the tier’s base rate plus its burst, which is what the server enforces and what RateLimit-Limit reports.
| Tier | All endpoints (requests / 60s) | AI endpoints (requests / 60s) |
|---|---|---|
basic | 600 | 300 |
standard | 3,000 | 2,400 |
advanced | 6,000 | 4,800 |
corporate | 3,000 | 2,400 |
enterprise | 6,000 | 4,800 |
Chat, agents, and media-generation endpoints are metered on the separate, lower AI ceiling in the right-hand column — also per user account. A request against one of those endpoints counts toward both ceilings.
Rate limit headers
Every response includes these headers so you can track your usage:
RateLimit-Limit — Your tier’s cap for the current 60-second window (requests-per-minute plus burst).RateLimit-Remaining — Requests remaining in the current window.RateLimit-Reset — Seconds until the current window resets.RateLimit-Policy header describing the active policy is also sent.When you hit the limit
The API returns 429 Too Many Requests with a Retry-After header indicating how many seconds to wait. We recommend exponential backoff with jitter.
Pagination
Pagination is per-endpoint — there are no cursors.
GET /api/tasks
limit integer — Items per page (default 50, max 100).offset integer — Number of items to skip (default 0).{ tasks, total }.GET /api/agents
page integer — Page number, 1-indexed (default 1).limit integer — Items per page (default 50, max 200).{ agents, departments, total, page, limit }.Example: paginate tasks with offset
# First page
curl "https://api.gwc-corp.com/api/tasks?limit=50" \
-H "Authorization: Bearer YOUR_API_KEY"
# Response: { "tasks": [ ... ], "total": 142 }
# Next page
curl "https://api.gwc-corp.com/api/tasks?limit=50&offset=50" \
-H "Authorization: Bearer YOUR_API_KEY"