HTTP API
API-key access to the same Pakt operations exposed through MCP.
The Pakt HTTP API projects the same operation catalogue, validation, account scope, and authorization path as MCP. It is intended for code-based agents that do not speak MCP. It never submits a signed request to a venue.
Authentication
Create a key from Dashboard → account menu → API keys. Copy the secret when it appears; Pakt stores only its digest and cannot show it again. Send it as a Bearer credential:
curl -H 'Authorization: Bearer pakt_sk_…' \
https://api.usepakt.ai/api/v1/pakt-templatesDo not put a key in a URL, browser bundle, repository, or log. Delete it from the same dashboard page if it is exposed. API keys are account- and environment-bound, and every request reads the account’s current access tier.
Endpoints
| Method | Path | Operation |
|---|---|---|
POST | /api/v1/pakt-drafts | draft pakt |
GET | /api/v1/execution-context | get execution context |
GET | /api/v1/portfolio | get portfolio |
GET | /api/v1/hyperliquid/perp-markets | list hyperliquid perp markets |
GET | /api/v1/pakt-templates | list pakt templates |
GET | /api/v1/pakts | list pakts |
POST | /api/v1/pakts/activation-requests | prepare pakt activation |
POST | /api/v1/pakts/{pakt_root}/disable-requests | prepare pakt disable |
POST | /api/v1/execution-proposals | propose execution |
POST | /api/v1/execution-completions | record execution completion |
GET | /api/v1/api-keys | list api keys |
POST | /api/v1/api-keys | create api key |
DELETE | /api/v1/api-keys/{key_id} | delete api key |
The browser-authenticated /api/v1/api-keys routes are used by the dashboard;
agent integrations use the remaining routes with a Pakt API key.
The authoritative OpenAPI 3.1 document is available at
https://api.usepakt.ai/api/openapi.json.
Its request schemas, required fields, exact bounds, authentication requirements,
and status codes are generated from the same operation catalogue as MCP.
Request and response rules
GETarguments are query parameters.POSTarguments are one JSON object, except Pakt disable: its root is in the path and its body is omitted or an empty JSON object.- Preserve decimal strings and large JSON integers exactly; do not round policy
or transaction values through a JavaScript
Number. - A
401means the API key is missing, malformed, deleted, or for another environment. A403means the account’s current tier does not permit the operation. - Pakt operation failures use the same typed fault payload and retry semantics as MCP. See Statuses and Errors.
- Submit a returned signed request unchanged. Pakt authorizes and signs; the calling agent remains responsible for venue submission and completion records.