API & keys

Settings → API & Keys has two sections: provider keys (BYOK) and API tokens. Both are available now.

Bring-your-own AI keys (BYOK)

By default, Wisteria runs AI features on Wisteria’s pooled keys — costs are included in your subscription. BYOK lets you swap those pooled keys for your own provider credentials per capability.

Capabilities

Each capability is configured independently. You can use your own Anthropic key for generation while keeping Wisteria’s pooled transcription key, for example.

Supported providers

AI generation & grading:

Speech transcription:

Adding a provider key

1. Go to Settings → API & Keys.
2. Under Provider keys, click Add provider key.
3. Choose the capability.
4. Choose the provider.
5. Select the model (or enter your Azure resource name and deployment name).
6. Paste your API key. Click Save.

Wisteria validates the key immediately — if it’s wrong, you’ll see an error before it’s saved. Keys are encrypted at rest (AES-256-GCM) and never returned in plain text. The page shows only that a key is configured and which provider/model it uses.

Testing a key

After adding, click Test on any configured capability. Wisteria makes a minimal API call to the provider and confirms the key is live. Use this after rotating a key to verify the new one works before the old context expires.

Rotating a key

Click Rotate on the capability row. Enter the new key. The old key is replaced atomically — there is no downtime window. Wisteria starts using the new key for all subsequent requests.

Removing a key (fall back to pooled)

Click the × on a configured capability row. Wisteria immediately falls back to its pooled key for that capability.

Why use BYOK?

• Cost transparency — usage shows in your own provider account, not marked up through Wisteria.
• Compliance — your AI usage appears in your provider’s logs, which can matter for data governance audits.
• Model control — pin your workspace to a specific model version, or move to a provider your security team has already approved.

Why stick with pooled keys?

• Zero operational overhead — nothing to manage, rotate, or monitor.
• No provider accounts required — useful for organisations that don’t yet have their own AI API contracts.

Wisteria public API

The Wisteria API lets external systems read and write workspace data. Authenticate with a per-workspace API token issued from this page.

Scopes

Issuing a token

1. Go to Settings → API & Keys.
2. Under API tokens, click New token.
3. Give it a name (used only for your reference in this page).
4. Select the scopes you want the token to carry.
5. Click Create. Copy the token immediately — it is shown once and not stored in plain text.

Revoking a token

Click Revoke on the token row. The token stops working within seconds. Issued tokens have no expiry otherwise — revoke when a key is no longer needed.

Base URL

https://getwisteria.com/api/v1/

Authentication

All requests use Bearer token auth:

Authorization: Bearer <your-token>

Endpoints

GET /api/v1/catalog — scope: catalog:read

Returns all courses in the workspace and their modules.

[
  {
    "id": "uuid",
    "title": "Onboarding 101",
    "emoji": "👋",
    "department_id": "uuid",
    "published": true,
    "published_at": "2026-05-10T09:00:00Z",
    "created_at": "2026-04-01T12:00:00Z",
    "modules": [
      { "id": "uuid", "title": "Week 1", "status": "published", "order": 0 }
    ]
  }
]

GET /api/v1/analytics — scope: analytics:read

Returns per-module completion stats, per-learner progress, and recertification summary.

GET /api/v1/users — scope: users:read

Returns workspace users. Query params: role, department_id, status (active | inactive), limit (max 500), offset.

{
  "users": [
    {
      "id": "uuid",
      "email": "alex@company.com",
      "full_name": "Alex Kim",
      "role": "learner",
      "department_id": "uuid",
      "department": "Finance",
      "is_active": true,
      "created_at": "2026-01-15T10:00:00Z"
    }
  ],
  "total": 1,
  "limit": 100,
  "offset": 0
}

POST /api/v1/users — scope: users:write

Upserts a user. If the email already exists in the workspace, updates their attributes. If not, creates a new account.

{
  "email": "alex@company.com",
  "full_name": "Alex Kim",
  "role": "learner",
  "department_id": "uuid"
}

Set "deactivate": true to deactivate an existing user without deleting them.

POST /api/v1/intake — scope: intake:create

Pushes a content item into Wisteria as a draft AI suggestion. The suggestion appears in the trainer’s Recommended queue for review — it does not create a module directly and cannot bypass the approval workflow.

{
  "title": "Q4 Safety Briefing",
  "content": "Full article or document text here…",
  "source_name": "Confluence",
  "source_url": "https://company.atlassian.net/wiki/spaces/HR/pages/123",
  "department_id": "uuid"
}

content and source_name are required. title, source_url, and department_id are optional. Content is capped at 50,000 characters.

Error codes