REST API reference

Base URL & authentication

GalaxyX API: https://api.galaxyx.net

Authorization: Bearer <YOUR_GALAXYX_API_KEY>
Content-Type: application/json

External clients should use a gx_ API key in the Authorization header. Send only the key value after Bearer, without a variable name or an equals sign. GalaxyX also accepts Firebase ID tokens as Bearer credentials. The website uses the HttpOnly __session cookie with credentials: 'include' and an allowed first-party Origin. A localhost cookie cannot authenticate requests to the production API host.

Sign in to GalaxyX with a registered, email-verified account, then open Settings to create, list, or revoke your API keys. You can also use the /v1/keys endpoints with a Firebase ID token or a session cookie and allowed Origin. API keys cannot create, list, or revoke keys: those requests return 403 and require account authentication.

Keep keys on your server, out of browser bundles, URLs, and logs. Save the full key when issued: it cannot be retrieved later. Limits: 5 active keys per account and 10 successful creations per one-hour window; revoking a key does not reset the creation count.

GalaxyX API endpoints

All paths above are relative to https://api.galaxyx.net. Versioned endpoints use /v1, without an /api prefix. API keys act on the account that created them; key management is limited to that account’s own keys.

Send a chat request

Choose a chat ID of 1–128 letters, digits, underscores, or hyphens. Reuse it to continue a conversation and supply the conversation context in recent_messages; the chat ID alone does not load prior messages into the request. Set new_chat to true when creating a room. Requests use JSON, including base64 file contents.

curl --no-buffer https://api.galaxyx.net/v1/agent/demo-chat \
  -H "Authorization: Bearer $GALAXYX_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: text/event-stream" \
  --data '{
    "message": { "text": "Help me plan a trip to Tokyo." },
    "new_chat": true,
    "language": "en",
    "recent_messages": [],
    "attachments": [],
    "config": { "temperature": 0.2, "maxOutputTokens": 8192 }
  }'

Streaming responses & errors

Chat returns Server-Sent Events (text/event-stream). Each data field contains JSON; read its status property rather than an SSE event name. Parse complete events separated by a blank line, buffering partial network chunks. Use fetch for POST requests; native EventSource cannot send this JSON body or Bearer header.

data: {"status":"room_created","id":"demo-chat","title":"Trip to Tokyo"}

data: {"status":"progress","text":"Searching on the web..."}

data: {"status":"final_answer","text":"Here is your itinerary...","chat_limit_reached":false}

• room_created / room_updated: room ID and title.
• progress: tool progress text.
• warning: code and message, for example an attachment save failure.
• error: code and user-facing message; treat this as a failed generation.
• final_answer: answer text, chat_limit_reached, and optional function_responses. This is the completed answer; title updates and warnings arrive before it.

Check the HTTP status before reading the stream. HTTP 200 alone does not mean generation succeeded: errors can arrive inside the stream. Disconnecting does not currently cancel upstream model work.

// Example validation error (HTTP 400)
{ "error": { "code": "INVALID_REQUEST", "issues": [
  { "path": "model", "message": "Unsupported model" }
] } }

• 400: invalid input or a disallowed guest profile update.
• 401: missing or invalid authentication.
• 402 TOKEN_LIMIT_REACHED: insufficient or invalid credit balance, or account usage restriction, before generation.
• 403: forbidden Origin, unverified/guest key management, attempting key management with an API key, or API_ACCESS_DISABLED.
• 404 NOT_FOUND: unavailable key; 409 KEY_LIMIT: active key limit reached.
• 413: body exceeds 20 MiB. 429 KEY_RATE_LIMIT: key creation limit; Retry-After: 3600.

Error bodies vary by endpoint; user profile routes also return string errors. Model and tool usage consumes credits. The balance check does not reserve credits across concurrent requests.