Endpoints
DocsReferenceEndpoints

API reference

Every endpoint, what it does and what it costs. The full contract is an OpenAPI 3.1 document.

Authentication

Send your secret key as a bearer token: Authorization: Bearer sk_live_…. Keys are for servers only. From a browser or an app, use a client token.

Endpoints

POST/api/v1/scanfrom $1.03 · metered

The Spoken scan, from an API call: photos in, a saved build out — owned by your Spoken account, public on spoken.fyi, every part identified, priced and linked. Build pages open for anyone with the link while the rest of Spoken is in its private beta; the API answer is complete regardless. Pass job for a poster and/or a film in the same call; stream: true for progress events and the parts as one final event (no build is saved).

POST/api/v1/scansfrom $1.03 · metered

The same scan as a JOB: a job id in about a second, and the work keeps going after you hang up. Poll GET /api/v1/scans/{id} (free) for progress and the result. save: false runs it headless — parts under the job id, nothing saved to spoken.fyi (bom only).

POST/api/v1/lists/parseFree

A parts list in (pasted text, or a CSV / XLSX / PDF file as base64), rows out. Free. Send the rows as parts on POST /api/v1/scans and the list becomes the build: every row a part, the photo places what it can.

POST/api/v1/uploadsFree

An upload slot for one photo: PUT the bytes to its upload_url with its headers (no key needed, up to 12 MB, about an hour), then scan with image_url set to its photo_url. For photos you hold as files — a phone photo is bigger than a request can carry as base64. A client token may ask for one, so a phone can send its photo straight up. Free.

POST/api/v1/client-tokensFree

Your server mints a short-lived client token (ct_…) with its secret key; your browser or app presents it to start ONE scan job (and read it) directly — no proxy, and a copied token is worth one scan, not your balance. Free.

GET/api/v1/scans/{id}Free

A scan job: status, progress (0-100), and the full result once done. Free — poll every 2 s; a retry after an Idempotency-Key returns the same job.

GET/api/v1/builds/{id}Free

A build record: parts, prices, buy links, pin geometry and media — the same read the build page makes.

DELETE/api/v1/builds/{id}Free

Delete one of your builds: the photos, poster plates and films we host, then the record. Free.

DELETE/api/v1/users/{user_ref}Free

Delete everything held for one of your users, by the pseudonymous user_ref you sent with their scans: builds, media, scan jobs. Billing rows stay, unlinked. Free.

GET/api/v1/catalog/search?q=Free

Search the component catalog (parts + brands).

GET/api/v1/usageFree

Usage, credit balance and plan status, by day or by month — with the plan's 50 / 80 / 100% warnings. Free.

POST/api/v1/builds/{id}/poster$0.20

Another poster from a build you already have — any of the product's poster styles; variant 1-99 is the app's Remake on the 9:16 styles.

POST/api/v1/builds/{id}/film$1.50

The app's Remake button: a new film from a build you already have (2 remakes per build per day, as in the app). Poll the same path with GET (free).

Metered prices are for the reference build: ten items from one photo. A scan costs what it finds.

Errors

Errors return JSON with a code and a message, and every response carries x-spoken-request-id — quote it when you contact us. A call your balance cannot cover is refused with 402 before any work starts.

Limits

Calls are rate-limited. Over a limit a call is refused with 429 and a retry-after header: wait that long and try again. On an enterprise plan a scan waits for capacity instead. Nothing is charged for a refused call.

User data

The only per-person field the API accepts is user_ref: your own pseudonymous token for the person — a hash or a random id, never a name, email or phone. Send it with each scan, or put it in the client token your server mints for a browser. It is kept with the scan and the build, counts distinct users in GET /api/v1/usage, and DELETE /api/v1/users/{user_ref} removes every build, photo, film and scan job held for that person at once; copies cached at the edge expire within an hour. Billing rows stay, with the token removed. DELETE /api/v1/builds/{id} removes one build the same way.

Use policy

Keys are for building products for your users. Probing or analyzing the API to work out how Spoken identifies products, copying results in bulk to train a model or build a competing dataset, and working around limits are not allowed — for you or for any script or AI agent acting for you. Read the policy.

The contract

GET https://spoken.fyi/api/v1/openapi.json is generated from the code that answers the calls. Every response carries x-spoken-api-version (currently 2026-10-24); it changes only for a breaking change.