Your ideas. Your workflow.
Bring content, projects and creative workflows into your application. Explore the reference, start with a public request, then build with account-scoped access.
One REST interface
JSON requests, explicit schemas and versioned endpoints.
Scoped by design
Separate public, customer and owner access.
Ready for your stack
Copy examples for cURL, JavaScript and Python.
API reference
98 operationsFrom first request to your workflow.
No SDK required. Use the HTTP client you already know.
Make a public request
Published content and storyboard templates are available without authentication.
curl 'https://api.alorevio.com/v1/templates'Create a project API key
Sign in to your developer workspace and create a named key. Keys are displayed once, expire after 90 days and can be revoked. Google login must be enabled by the platform owner first.
Create your first project
Keep your key in your server's secret store. Replace the environment variable below with your configured secret, never a key committed to source.
curl 'https://api.alorevio.com/v1/projects' \
-H "Authorization: Bearer $ALOREVIO_API_KEY" \
-H 'Content-Type: application/json' \
--data '{"title":"My first story","kind":"story","aspect_ratio":"16:9","script_text":"Scene 1: Introduce your idea."}'The right access for every workflow.
Public endpoints
Published posts, pages, FAQs and templates require no credentials. These read endpoints support cross-origin requests.
Project API keys
Send Authorization: Bearer alv_… on /v1/projects. Each key can manage only its creator's projects. It cannot read customer support, create keys or access the owner CMS. Keys expire after 90 days and revocation takes effect on the next request.
Customer sessions
/v1/me/* uses a Secure, HttpOnly session cookie created by Google sign-in. Browser writes must originate from this API origin. The API does not enable credentialed cross-origin access.
Owner administration
/v1/admin/* requires a cryptographically verified Cloudflare Access application JWT and an allowed owner identity. Send the application JWT as a Bearer token. A customer key or an email header never grants owner access.
Errors you can act on.
Every API response includes an X-Request-ID, an X-API-Version and Server-Timing. Share the request ID with support when investigating a failed call.
Structured problem details
Error responses use application/problem+json with RFC 9457 fields. The stable error code is retained for existing clients.
{
"type": "about:blank",
"title": "Authentication required",
"status": 401,
"error": "sign_in_required",
"detail": "sign in required",
"instance": "/v1/me/projects",
"request_id": "…"
}Response codes
| Code | Meaning | What to do |
|---|---|---|
| 400 | Malformed request | Check JSON syntax. |
| 401 | Authentication required | Sign in or replace an expired key. |
| 403 | Forbidden | Check your access scope and request origin. |
| 404 | Not found | Check the identifier and account ownership. |
| 409 | Conflict | Reload changed settings; review uncertain mail delivery. |
| 413 | Payload too large | Reduce the request size. |
| 415 | Unsupported content type | Send Content-Type: application/json. |
| 422 | Validation failed | Check the field types, values and constraints. |
| 429 | Rate limit reached | Respect Retry-After; use backoff with jitter. |
| 502 | Provider unavailable | Check integration setup; avoid blindly retrying writes. |
| 503 | Unavailable or disabled | Check platform capabilities and provider setup. |
Safe retries
Retry idempotent reads with capped exponential backoff. Project creation is not idempotent: do not blindly retry it. Mail and support follow-ups use a body idempotency_key; retry with the same key and unchanged content. Uncertain Cloudflare mail deliveries require review instead of an automatic resend.
Predictable reads. Controlled traffic.
Pagination
Paginated lists accept limit (1–100, default 25) and offset (default 0). Follow pagination.next_offset until it is null. Lists can change between requests; offset pagination is not a snapshot.
{
"items": [],
"pagination": { "limit": 25, "offset": 0, "next_offset": null }
}Project search and export
Use q for literal title search and status=draft or status=archived to filter projects. Export one project with /{id}/export?format=json or format=txt. Every result remains scoped to your identity.
Edge rate limits
API reads allow approximately 120 requests per minute per client IP; writes allow 30. Cloudflare's limiter is per edge location and eventually consistent, so this is traffic protection rather than a strict global billing quota. Shared-IP clients share that budget. A limited request returns 429 and Retry-After: 60. The X-RateLimit-Policy header reports the active policy.
Conditional requests
OpenAPI and template reads return an ETag. Send it in If-None-Match to receive 304 when unchanged. Published CMS reads are not cached, so editorial changes stay visible.
Bounded requests
JSON request bodies are streamed with endpoint-specific size limits. AI drafting has an additional per-customer daily attempt allowance when enabled. Read the schema and integration settings for field limits.
A growing platform. A stable contract.
25 October 2026 · Developer platform
Searchable OpenAPI reference, cURL/JavaScript/Python examples, public request explorer, problem details, request IDs, edge rate limits and conditional template/specification reads.
Platform 0.2
Scoped project API keys, customer workspace, CMS publishing, support conversations, Google sign-in setup, Gemini/Vertex AI configuration, native Cloudflare mail and weekly draft scheduling.