> ## Documentation Index
> Fetch the complete documentation index at: https://docs.praxis-ai.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Set the authorized-source allowlist for the caller's personal API key
> Restricts which sources may exchange this API key for a JWT at POST /api/auth/api-key-signin. Entries are auto-classified as web origins ("https://app.example.com", "*.example.com") or network sources ("52.206.211.0/24", "1.2.3.4") and are normalized before storage. An EMPTY list means the key is open (no enforcement) — existing keys are unaffected until a list is saved.
Security notes: network entries are matched against the resolved client IP and cannot be spoofed; web origins are matched on the Origin header, which non-browser clients can set freely, so an origin entry constrains browser use only. A MIXED list is therefore only as strong as its weakest entry — the response returns `mixed: true` so callers can surface that. The Referer header is deliberately not accepted. Survives key rotation.
## OpenAPI
````yaml /mdx/api-reference/runtime/runtime-api.json put /api/user/api-key/sources
openapi: 3.0.0
info:
title: Pria Runtime API
version: 2.0.1
description: >-
Pria API Documentation Praxis's developer platform is a core part of our
mission to empower organizations to grow better. Our APIs are designed to
enable teams of any shape or size to build robust integrations that help
them customize and get the most value out of Pria. All Pria APIs are built
using REST conventions and designed to have a predictable URL structure.
They use many standard HTTP features, including methods (POST,
GET, PUT, DELETE) and error response codes.
All API calls are
made under https://hiimpria.ai/api and all responses return standard JSON.
In these docs, you'll find lists of all available endpoints for a given API,
along with interactive code blocks for building requests. For walkthroughs
of basic usage for these APIs, check out the API guides.
servers:
- url: https://pria.praxislxp.com
description: Pria API Server
security: []
tags:
- name: Authentication
description: User authentication, registration, and password management (/api/auth)
- name: OAuth
description: OAuth authentication providers - Google, GitHub, SSO (/api/auth/oauth)
- name: User
description: User profile management and account operations (/api/user)
- name: User Institutions
description: User institution memberships and switching (/api/user/institution)
- name: User Tools
description: Available tools for authenticated users (/api/user/tools)
- name: Institutions
description: Institution settings and configuration (/api/user/institution)
- name: Conversation
description: AI conversation and Q&A endpoints (/api/ai)
- name: Realtime
description: Real-time voice AI and WebRTC sessions (/api/ai/rt)
- name: Assistant
description: AI assistant configuration and management (/api/user/assistant)
- name: History
description: Conversation history and favorites (/api/user/history)
- name: RAG
description: >-
Document upload, embedding, and retrieval-augmented generation
(/api/user/files, /api/user/rag)
- name: Setting
description: Instance variables and settings management (/api/user/setting)
- name: Branding
description: Digital twin branding and customization (/api/agent/branding)
- name: Agent
description: Agent engagement and session management (/api/agent)
- name: SDK Launch
description: >-
SDK launch token signing and verification for secure iframe embedding
(/api/auth/sdk-sign, /api/auth/sdk-verify)
- name: Testing
description: Health checks, diagnostics, and test endpoints (/api/test)
- name: Admin Accounts
description: Account management for super admins (/api/admin/account)
- name: Admin Institutions
description: Institution management for admins (/api/admin/institution)
- name: Admin Users
description: User management for admins (/api/admin/user)
- name: Admin Entitlements
description: >-
User-institution relationships and permissions
(/api/admin/userInstitution)
- name: Admin Sessions
description: Session management for admins (/api/admin/session)
- name: Admin Histories
description: Conversation history management and analytics (/api/admin/history)
- name: Admin Assistants
description: AI assistant management for admins (/api/admin/assistant)
- name: Admin Questions
description: Institution question and prompt management (/api/admin/question)
- name: Admin Tools
description: Tool configuration management (/api/admin/tool)
- name: Admin AI Models
description: AI model configuration (/api/admin/aimodel)
- name: Admin MCP Servers
description: Model Context Protocol server management (/api/admin/mcpserver)
- name: Admin Feedbacks
description: User feedback management (/api/admin/feedback)
- name: Admin Uploads
description: Upload management (/api/admin/upload)
- name: Admin Charts
description: Analytics and visualization chart management (/api/admin/chart)
- name: Audio Notes
description: Capture and ingest spoken notes into the personal vault
- name: Memory
description: User-facing memory parameters (personal + shared instance memory).
- name: My Data
description: >-
GDPR controls — personal-scope counts, async ZIP-by-email export, and
scoped soft-delete. Every endpoint pins `user = req.user._id` AND
`institution: null`; institution-scoped data is governed by the
institution's own retention policy and never reached from here.
- name: Questions
description: >-
User-facing read of the onboarding question bank used by the "create a
digital twin" wizard.
- name: Transcription
description: >-
One-shot speech-to-text for in-place dictation. Audio blob in, transcript
out — no Upload / History / RAG embeddings are persisted. Use
`/audio-notes` for anything durable.
paths:
/api/user/api-key/sources:
put:
tags:
- User
summary: Set the authorized-source allowlist for the caller's personal API key
description: >
Restricts which sources may exchange this API key for a JWT at POST
/api/auth/api-key-signin. Entries are auto-classified as web origins
("https://app.example.com", "*.example.com") or network sources
("52.206.211.0/24", "1.2.3.4") and are normalized before storage. An
EMPTY list means the key is open (no enforcement) — existing keys are
unaffected until a list is saved.
Security notes: network entries are matched against the resolved client
IP and cannot be spoofed; web origins are matched on the Origin header,
which non-browser clients can set freely, so an origin entry constrains
browser use only. A MIXED list is therefore only as strong as its
weakest entry — the response returns `mixed: true` so callers can
surface that. The Referer header is deliberately not accepted. Survives
key rotation.
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
allowedSources:
type: array
maxItems: 20
items:
type: string
example:
- 52.206.211.0/24
- '*.example.com'
enforceSources:
type: boolean
description: >
When false (default), a non-matching sign-in still succeeds
and is only audited (warn-first rollout). When true,
non-matching sign-ins are rejected with 403.
example: false
responses:
'200':
description: Saved
content:
application/json:
schema:
type: object
properties:
success:
type: boolean
allowedSources:
type: array
items:
type: string
enforceSources:
type: boolean
mixed:
type: boolean
description: True when the list mixes origin and network entries.
'400':
description: >-
Invalid entry, more than 20 entries, a /0 prefix, or enforcement
requested with an empty list
'401':
description: Authentication required
'403':
description: Admin access required
security:
- bearerAuth: []
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWT
description: JWT token passed in authorization header
````