Authentication

All data endpoints require a valid API key passed via the x-api-key header.

curl -H "x-api-key: sk_your_key_here" \
  https://api.hermaeus.xyz/v1/entities/search?q=Tesla

Authorization: Bearer sk_your_key_here may also be accepted as a compatibility alias, but x-api-key is the primary documented header.

API keys

Keys are created and managed from the dashboard. Each key is scoped to a workspace — all billing and rate limiting attach to the workspace, not the individual key.

• Keys use the sk_ prefix.
• The full key is shown once at creation. It cannot be retrieved later.
• Multiple keys per workspace are supported from day one. Use separate keys for separate environments.
• To rotate a key: create a new one, verify it works, then delete the old one.

Rate limits

When you exceed your rate limit, the API returns 429 Too Many Requests with a Retry-After header.

When you exceed your monthly cap, the API returns 429 Too Many Requests with a monthly_cap_exceeded error until the next billing cycle. Hermaeus does not charge overage fees in the current v1 model.

Error responses

All errors follow a consistent shape:

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or missing API key."
  }
}