AI OS API for tiers, skills,blueprints and guides

The AI OS API is the one place that decides what your account may take: which tier you are on, what is in the catalogue for you, and whether you have used today's allowance. The MCP server and the CLI are both clients of it, so an agent is never the only way in.

What is live today

Nothing yet. Every endpoint on this page is planned rather than answering.

The client already calls all 11 of them, and the server behind them has not been built. api.aios.guide has no DNS record, so a request made today fails before it reaches anything.

This page is here because the contract is settled and it is what the software already expects. It is not here to suggest you can call it. Each endpoint below carries a badge saying which it is, and those badges change as endpoints ship rather than this paragraph quietly disappearing.

Everything on your own machine works regardless. The audit, the context tools and the rest never touch this API, which is the reason they work signed out and offline.

Introduction

The AI OS API is a registry and an account. That is the whole of it, and keeping the description that small is what stops it sprawling.

There are 2 things worth exposing. A catalogue that grows, which is the skills, the blueprints, the guides and the files that make up each tier's release. And an account, which says who you are and what you may take.

Almost every request is a read, which is why it is cheap to run and safe to open up. There are no endpoints that change anything on day one.

It exists because something has to answer "what tier is this key, what is in the catalogue for them, and have they hit their limit". That logic either gets scattered through 3 surfaces where a customer could edit it, or it lives in 1 place on a server where they cannot. The CLI, the local MCP server and the hosted MCP server are all clients of this.

Base URL

https://api.aios.guide

Every path on this page hangs off that host, so /v1/whoami is https://api.aios.guide/v1/whoami.

Point the client somewhere else with AIOS_API_URL when you are testing against your own server. That is the only reason to change it.

Requests carry Accept: application/json and a User-Agent naming the client and its version. A request that gets no answer within 30 seconds is abandoned, and the client says which of the 2 happened rather than reporting a bare failure.

Versioning

The version is in the path, from the very first request. /v1.

An unversioned API is a promise nobody can keep. Putting it in the path rather than in a header means you can see which version a request used by reading the request.

Anything added inside /v1 is additive: a new field, a new endpoint, a new optional parameter. Read what you need and ignore what you do not recognise, and an addition cannot break you. Anything that would break a caller goes in /v2 instead.

Authentication

A bearer token in the Authorization header.

Authorization: Bearer aios_...

You are not expected to ever see one. aios-cli login opens your browser, you sign in, and the key is written to ~/.aios/session.json with permissions that keep it to your own account. Nothing is displayed and nothing is pasted, the same way gh auth login works.

AIOS_API_KEY in the environment overrides that file, which is what a build server would use.

The token belongs to your account, never to a tier. Upgrade and every key you already have gains the new access on its very next request, with nothing to reconnect and no support mail.

Some endpoints need nothing at all. What exists in the catalogue is public, because a list of what you could have is not a secret. The files behind an entry are not.

Rate limits

Every request costs a weight rather than 1, so an expensive endpoint cannot be called 500 times inside a limit sized for cheap ones. The weights are the same numbers the tools carry on the MCP page.

Counting is per key, per day, in UTC. A refusal names the time it resets, and carries retry_after along with the standard rate limit headers, so a client can wait the right amount rather than guessing.

The allowances for AI OS Starter, AI OS Pro and AI OS Max are not published here yet, because the gating is not built yet. This page gets them when they are real.

Public endpoints are limited per address instead of per key, and most of them are answered from a cache without anything running at all.

Errors

One shape, whatever went wrong, so a client branches on a field instead of matching on a message.

{
  "error": "tier_required",
  "message": "AI OS Pro is required for this skill.",
  "required_tier": "pro",
  "your_tier": "starter",
  "upgrade_url": "https://aios.guide/pricing"
}
Errors
ErrorHTTPCLI exitWhat it means
usage4002The request was wrong: a missing parameter, a bad value, or a write that was not confirmed. Nothing happened.
not_found4043There is no skill, blueprint or guide with that slug.
auth401, 4034The key was missing, rejected or revoked. Sign in again.
tier_required4022Your tier does not include this. The body names the tier that does, and where to get it, so the answer is what you would gain rather than only what you cannot have.
rate_limited4297You have used today's allowance. The body carries retry_after and the response carries the standard rate limit headers.
api5005Something went wrong at our end. Safe to retry, with a pause.

A machine branches on error, a person reads message, and an agent has a URL it can hand over. That is why the message is written as a sentence rather than a code.

The CLI turns each of these into a number a script can act on. Those are on the MCP and CLI page.

Endpoints

11 of them, which is every path the client calls. Grouped the way you would read them: your account, then the catalogue, then the files.

GET/v1/whoamiPlanned

Who you are

Returns the account behind the key, which tier it is on, and how much of today's allowance is left. This is the request to make when something has been refused and you want to know why.

Bearer token · Called by whoami

Example response

{
  "tier": "starter",
  "account": {
    "id": "acc_8f2c1d",
    "email": "you@example.com",
    "name": "Your name"
  },
  "usage": {
    "used": 12,
    "limit": 50,
    "remaining": 38,
    "resets_at": "2026-09-07T00:00:00Z"
  }
}
GET/v1/tiersPlanned

The tiers

Returns the 3 tiers and what each one includes. Public, because what you would be buying is not a secret.

No sign-in · Called by upgrade_info

Example response

{
  "tiers": [
    { "slug": "starter", "name": "AI OS Starter" },
    { "slug": "pro", "name": "AI OS Pro" },
    { "slug": "max", "name": "AI OS Max" }
  ]
}
GET/v1/skillsPlanned

Search the catalogue

Searches the skills catalogue and returns what matches, with the tier each one needs. Metadata only. The files behind a skill are a separate request.

No sign-in · Called by skills_search

/v1/skills Parameters
ParameterWhat it is
qWhat you are looking for, in plain language.
limitHow many to return, 1 to 50. Defaults to 10.
cursorContinue from where a previous page stopped.

Example response

{
  "skills": [
    {
      "slug": "newsletter-writer",
      "name": "Newsletter writer",
      "summary": "Drafts a newsletter in your voice from a rough outline.",
      "required_tier": "starter",
      "updated_at": "2026-08-20"
    }
  ],
  "next_cursor": null
}
GET/v1/skills/{slug}Planned

One skill

Returns everything about one skill except its files, so you can say what it would add before anything is written.

No sign-in · Called by skills_get

/v1/skills/{slug} Parameters
ParameterWhat it is
slugThe skill's slug, from a search.
GET/v1/skills/{slug}/filesPlanned

A skill's files

Returns the files that make up a skill, which is what an install actually writes. This is the request that checks your tier, and it refuses with the tier you would need rather than a bare no.

Bearer token · Called by skills_install

/v1/skills/{slug}/files Parameters
ParameterWhat it is
slugThe skill's slug.

Example response

{
  "slug": "newsletter-writer",
  "name": "Newsletter writer",
  "files": [
    { "path": "SKILL.md", "contents": "---\nname: newsletter-writer\n..." }
  ]
}
GET/v1/blueprintsPlanned

The blueprints

Returns every writing guide and template: how to write a CLAUDE.md, an AGENTS.md, a voice file, and the rest.

No sign-in · Called by blueprint_list

/v1/blueprints Parameters
ParameterWhat it is
kindNarrow it to one subject, for example voice or writing.
GET/v1/blueprints/{slug}Planned

One blueprint

Returns one blueprint in full: the method, a template and worked examples. This is what makes an agent write in your method rather than its own defaults.

Bearer token · Called by blueprint_get

/v1/blueprints/{slug} Parameters
ParameterWhat it is
slugWhich blueprint. For example claude-md, voice or anti-slop.
GET/v1/content/{slug}Planned

One guide

Returns one page from aios.guide in full, as markdown. Markdown rather than HTML, because an agent asking for a page wants 4KB of text and not 200KB of markup.

No sign-in · Called by docs_get

/v1/content/{slug} Parameters
ParameterWhat it is
slugThe page slug, from a search.
GET/v1/audit/rulesPlanned

The audit rules

Returns the checks the audit runs. They live here rather than in the package for 2 reasons: the set improves without anybody reinstalling, and it is where a paid tier adds depth. Your files are never sent here. The rules travel to you and the reading happens on your machine.

Bearer token · Called by os_audit

Example response

{
  "rules": [
    {
      "id": "secret-in-context",
      "kind": "secret",
      "severity": "critical",
      "title": "A credential is sitting in a context file",
      "next": "Move it into your password manager and rotate it."
    }
  ]
}
GET/v1/releases/currentPlanned

The current release

Returns every file in the release for your tier, each with a hash. An update compares those hashes against what is on your disk and writes only what changed, which is how it can leave your own edits alone instead of overwriting them.

Bearer token · Called by os_update

Example response

{
  "tier": "starter",
  "version": "1.4.0",
  "files": [
    { "path": "CLAUDE.md", "hash": "a1b2c3d4e5f6..." },
    { "path": "context/voice.md", "hash": "9f8e7d6c5b4a..." }
  ]
}
Was this page helpful?