Manage API Reference

This page is aligned with current backend code and focuses on public Manage interfaces.

Base Information

• Base URL: https://api.xairouter.com
• Auth: Authorization: Bearer sk-Xvs...

export BASE_URL="https://api.xairouter.com"

Endpoint Overview

1) Subaccount Management (/x-users / /x-dna)

1.1 Create subaccount

POST /x-users

Minimal payload:

{
  "Name": "dev-account",
  "Email": "[email protected]",
  "CreditGranted": 100
}

Common optional fields:

• Alias, BillingEmail
• Rates
• RPM/RPH/RPD, TPM/TPH/TPD
• AllowIPs, AllowModels, AllowLevels
• Resources
• ModelLimits

Rate-limit field semantics

• RPM/RPH and TPM/TPH: short-window throttles.
• RPD/TPD: natural-day quotas based on the server-side business date, not rolling 24-hour windows.
• Hitting a short-window limit enters an independent cooldown; repeated retries can refresh that cooldown.
• After RPD/TPD is exhausted, cooldown only lasts until the end of the current day; retries do not push recovery past the next day boundary.
• TPD is accrued from successful token usage. If one successful request pushes the day over the cap, 429 TPD usually starts on the next request.
• ModelLimits use the same semantics as user-level limits, but accounting is merged into the effective model so aliases or upstream snapshot names do not split counters.

ModelLimits example:

{
  "gpt-5": {
    "RPM": 60,
    "RPH": 1000,
    "RPD": 5000,
    "TPM": 200000,
    "TPH": 2000000,
    "TPD": 10000000
  }
}

1.2 Query children and descendants

• GET /x-users: direct children
• GET /x-dna: all descendants
• GET /x-users/{identifier}, GET /x-dna/{identifier}: path filtering

Query params:

• id, name, email, level, dna
• page, size
• order

Path identifier supports:

• numeric ID
• username
• email
• DNA path (. prefix)
• prefix filters: L{n}, G{n}, R{n}, T{n}, F{n}

1.3 Update subaccount

PUT /x-users/{identifier} or POST /x-users/{identifier}

Public fields commonly used:

• profile: Name, Email, Alias, BillingEmail, QRCode
• state: Status, Suspended
• credits: CreditGranted, Days, Rates
• limits: DailyLimit, HardLimit, SoftLimit, UserLimit, AutoQuota
• rate limits: RPM/RPH/RPD, TPM/TPH/TPD
• ACL: Resources, AllowIPs, AllowModels, AllowLevels
• mapping/limits: ModelMapper, ModelLimits

Owner extras: Level, Role, Factor, LevelMapper.

1.4 Delete subaccount

DELETE /x-users/{identifier}

2) Descendant Billing (/x-bill)

GET /x-bill

Query params:

• date: date / d
• range: start / s, end / e
• days: days
• user filter: user / u

3) Self Key Rotation (/x-self)

POST /x-self

{
  "confirm": "YYYY-MM-DD-ROTATE-SELF",
  "key": "sk-Xvs..."
}

• confirm must match the current date phrase
• key is optional; backend can auto-generate

4) Dashboard (/dashboard/*)

• GET /dashboard/status: permissions and status
• GET /dashboard/info: account detail
• GET /dashboard/live: real-time usage
• GET /dashboard/bill: current account billing
• GET /dashboard/logs: operation logs
• GET /dashboard/news: notifications
• GET /dashboard/models: model list

Only business-facing fields are documented. Internal billing-correction fields and maintenance interfaces are excluded.