API reference

The NexBasira public API is REST + JSON, versioned under /api/v1/public/*. Every endpoint is auth'd via your cvp_pub:cvp_sec credential pair, scope-gated, and cursor-paginated where it returns a list.

Base URL

https://app.nexbasira.com/api/v1/public

For self-hosted installations, swap the host with your own. Path is the same.

Sections

• Authentication — credential pair, signing scheme, scope catalog
• Pagination + idempotency — cursor pagination + Idempotency-Key header
• Errors + rate limits — error envelope shape, X-RateLimit-* headers
• Sessions — create, list, retrieve, end, invite
• Evidence — list, retrieve, signed download URL
• Whiteboards — list per session
• Webhook endpoints — register / rotate-secret / test-fire
• Branding — read-only on the public API; mutations via the SPA
• Org — read-only org metadata

OpenAPI schema

A filtered OpenAPI 3.1 spec (only the public-api-tagged operations) is served at https://app.nexbasira.com/api/public-schema/. Use it directly with code generators:

# Node typed types
npx openapi-typescript https://app.nexbasira.com/api/public-schema/ -o src/nb-types.ts

# Python typed models
datamodel-codegen \
  --url https://app.nexbasira.com/api/public-schema/ \
  --input-file-type openapi \
  --output-model-type pydantic_v2.BaseModel \
  --output cvp_models.py

Our SDKs (@nexbasira/node + nexbasira for Python) are built on top of these generated types and add hand-written ergonomics on top — typed errors, async-iterator pagination, webhook-verify helpers.

API stability

The public API follows semver-by-URL-namespace. Breaking changes ship under a new prefix (/api/v2/public/*) with at least 12 months of overlap before the previous version is retired. Additive changes (new optional fields, new endpoints, new event types) ship in place; the SDKs treat unknown fields as forward-compatible.