OpenAPI 3.1 · v1.0.0

SisiDesk Public API

Drive workspaces and streaming sessions from your own tooling. The API is the same vendor-neutral session broker interface the SisiDesk dashboard calls, so anything the product can do, your automation can do too.

Download OpenAPI spec Get an API key

Authentication

Every request carries a scoped key. Keys are stored as SHA-256 hashes — the plaintext is shown once at creation and can be rotated or revoked at any time.

curl https://sisidesk.com/api/public/v1/me \
  -H "Authorization: Bearer $SISIDESK_API_KEY"

workspaces:read
List workspaces and read their configuration.
workspaces:write
Create workspaces and change their size or region.
sessions:read
List sessions and inspect their state.
sessions:write
Start and stop streaming sessions.
usage:read
Read metered compute, egress and cost.

GET/api/public/v1/me

Identify the calling key

Returns the account the key belongs to plus the scopes it carries. Requires any valid key.

Example request

curl -X GET https://sisidesk.com/api/public/v1/me \
  -H "Authorization: Bearer $SISIDESK_API_KEY"

Operation schema

{
  "tags": [
    "Identity"
  ],
  "operationId": "getMe",
  "summary": "Identify the calling key",
  "description": "Returns the account the key belongs to plus the scopes it carries. Requires any valid key.",
  "responses": {
    "200": {
      "description": "The authenticated account.",
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "user_id": {
                "type": "string",
                "format": "uuid"
              },
              "email": {
                "type": "string",
                "format": "email"
              },
              "plan": {
                "type": "string",
                "example": "pro"
              },
              "scopes": {
                "type": "array",
                "items": {
                  "type": "string"
                }
              }
            }
          }
        }
      }
    },
    "401": {
      "description": "Missing, unknown or revoked API key.",
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "error": {
                "type": "object",
                "properties": {
                  "code": {
                    "type": "string"
                  },
                  "message": {
                    "type": "string"
                  }
                },
                "required": [
                  "code",
                  "message"
                ]
              }
            }
          }
        }
      }
    },
    "403": {
      "description": "The key lacks the required scope.",
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "error": {
                "type": "object",
                "properties": {
                  "code": {
                    "type": "string"
                  },
                  "message": {
                    "type": "string"
                  }
                },
                "required": [
                  "code",
                  "message"
                ]
              }
            }
          }
        }
      }
    },
    "429": {
      "description": "Too many requests. Retry after the window resets.",
      "content": {
        "application/json": {
          "schema": {
            "type": "object",
            "properties": {
              "error": {
                "type": "object",
                "properties": {
                  "code": {
                    "type": "string"
                  },
                  "message": {
                    "type": "string"
                  }
                },
                "required": [
                  "code",
                  "message"
                ]
              }
            }
          }
        }
      }
    }
  }
}

Rate limits

Published policy. Enforcement ships with the streaming substrate — build against these numbers now and your client will not need changing.

60 req / minute
Per API key, all endpoints
5,000 req / day
Per API key, rolling 24 hours
10 starts / minute
POST /sessions only

Throttled requests will return 429 rate_limited alongside these headers:

Retry-After: 30
X-RateLimit-Limit: 60
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1767225600

Retry with exponential backoff and jitter. Need a higher ceiling? Contact support with your expected request volume.

Errors

Errors are always JSON in the shape { error: { code, message } }.

401 unauthorized — missing, unknown or revoked key.
403 insufficient_scope — the key lacks the scope the endpoint needs.
404 not_found — the resource does not belong to the calling account.
429 rate_limited — reserved for the request-throttling layer.
500 internal_error — transient; retry with backoff.