API reference

Ragextract's REST API does what the app does: it puts documents into a workspace, builds a table of questions over them, runs it, and hands back answers with the page each one was read from.

Base URL

Every request goes to https://api.ragextract.com over HTTPS. There is no sandbox host — a workspace you create for testing is the sandbox, and work in it is charged in credits like any other.

Request

curl https://api.ragextract.com/v2/workspaces \
  -H "x-api-key: $RAGEXTRACT_API_KEY"

Versions

This reference documents v2, the current API. Every path below begins /v2, and every one is authenticated with a personal API key (psk_…).

A /v1 also exists and is frozen. Its credential is a workspace key (sk_…) which is a workspace, so none of its paths name one; it has no tables and no bundles, and it takes no new parameters. If you hold an sk_ key nothing on these pages will match — mint a personal key and use v2.

Everything hangs off a workspace

A personal key belongs to a person inside one organisation and reaches every workspace that person can, so unlike v1 it cannot imply which workspace you mean. Every resource path therefore names one:

Path shape

/v2/workspaces/:workspaceId/files
/v2/workspaces/:workspaceId/tables/:tableId/columns
/v2/workspaces/:workspaceId/bundles/:bundleId/files

There are exactly three paths that do not, and they are the three where no workspace is knowable: GET /v2/verify and GET /v2/workspaces, which answer what this key can reach, and GET /v2/share/:fileItemId, which a browser redeems with a signed token and no API key at all.

The response envelope

Every successful response is success, total and data. total is the number of items in data and is present on single-item responses too, where it is 1. Collection endpoints additionally echo the query they were given.

Response

{
  "success": true,
  "total": 2,
  "data": [
    { "id": "wks_7Kq2mB4nR8vXpL3d", "name": "Acme diligence", "level": 3, ... },
    { "id": "wks_Zf9tY1cH6sQwE0aN", "name": "Portfolio 2026",  "level": 1, ... }
  ],
  "offset": 0,
  "limit": 25
}

Conventions

Timestamps are epoch milliseconds, as numbers — never ISO strings. Fields ending At are nullable unless a page says otherwise.
Ids carry a type prefix. wks_ workspace, ds_ file, dsx_ file item (a page), dsj_ job, rev_ table, rcol_ column, rrow_ row, rcel_ cell, rrun_ run, bndl_ bundle. Treat them as opaque strings; the suffix format is not contract.
The API calls a document a file. The app does too. Two endpoints leak the older spelling in their responses and this reference flags each where it happens — see Jobs and Search.
Unknown request keys are dropped, not rejected. A misspelled parameter returns 200 with the option silently ignored, so check a parameter's spelling here before concluding it does nothing.
Bodies are JSON, except the upload endpoints, which take multipart/form-data because they carry a file.

Credits

Three things spend credits, and all three are reachable from here: ingesting a document (1 credit per page), running a table cell (the column's rate), and search. Nothing else costs anything — listing, reading, creating a table and pricing a run are all free. The pricing page has the rates and the docs have how a balance behaves.

Where an endpoint spends, this reference says so on the endpoint.

Where to start

Authentication — the header, what a key reaches, and the rate limits — then Errors, because this API returns failures in two different shapes and a client that assumes one will break on the other.

After that the rail is in resource order, which is also build order: a workspace, the files in it, a table over those files, and the run that fills it in.

If you have not seen the whole path end to end, the overview has it as one block of curl.