Canonset: The Canonset API

The Canonset API gives your pipeline read-only access to your company's projects and approved answers. You create keys on the API page of your client account and call three endpoints with Authorization: Bearer cs_live_…. Every export is in our audit log.

Keys

On API in your client account, name a key for what uses it, for example "training pipeline", and create it. The key is cs_live_ followed by 32 characters. It is shown once, with a copy button; we store only a hash, so copy it then.

• Keys are read-only, and read only your company's projects and exports.
• Up to 10 keys can be active at once. To create another, revoke one you no longer use.
• The API page shows each key's name, prefix, who created it, when, and when it was last used.
• Revoking a key stops it at once. This can't be undone; create a new key instead.

Creating and revoking keys are recorded in our audit log.

The base address and authentication

Requests go to https://www.canonset.com/api/v1, with the key in the Authorization header:

curl https://www.canonset.com/api/v1/projects \
  -H "Authorization: Bearer cs_live_…"

Everything the API returns is read through a database role that can see only your company's rows, a second lock behind the application's own checks.

Endpoints

GET /projects: your company's projects, as {"data": [...]}. Each project: id, name, status, task_type, domain, deadline, delivered, in_review, in_progress, progress, created_at.

GET /projects/{id}/export?format=raw|dpo|harbor&since=<ISO 8601 time>: the project's approved answers. format=raw (the default) gives the same JSONL lines as the export button, one approved answer a line. format=dpo gives preference pairs. format=harbor gives a coding-task project as a zip of Harbor task directories, ready for harbor run. since returns only answers approved after that time: keep the largest approved_at you have seen and pass it next time. See Export formats.

curl "https://www.canonset.com/api/v1/projects/PROJECT_ID/export?format=raw&since=2026-10-01T00:00:00Z" \
  -H "Authorization: Bearer cs_live_…"

Every export response carries a Link header with rel="describedby", pointing at the project's datasheet.

GET /projects/{id}/datasheet: the delivery's datasheet as Markdown: where the data came from, the counts, how it was made and checked, the quality figures and the rights in it, as of the moment you ask. See The datasheet.

Limits and errors

Each key may make 60 requests a minute. Past that the API answers 429 with a Retry-After header saying how many seconds to wait.

Errors are JSON, {"error": {"message": "…"}}:

Responses are never cached (Cache-Control: no-store).

The audit log

Every export through the API is recorded in our audit log under the key's name and your company, with the format and since you asked for. To hear when new answers are ready instead of polling, add a webhook; see Webhooks and the signature.

Questions: support@canonset.com.