REST API overview, authentication, and limits

The REST API is an HTTP interface for reading and writing the assets, scenes, checkpoints, and builds of OasisW projects from a program. Use it to upload script files from an external editor or build tool, or to fetch the list of published apps. You don't need it to make games in the editor.

Base URL

https://oasisw.ai/api/rest

Create a token

On the left of the oasisw.ai dashboard, click Settings.
In the API tokens section, click Issue token. The section is labeled Only visible to you and has the description "Reaches every project you can open, including workspaces you manage."
In the Issue API token dialog, enter what the token is for in Token name (1–40 characters, for example Build script). Click Issue.
A 32-character token of lowercase letters and digits appears with Copy it now. You can’t see it again after closing. Click Copy, keep it somewhere safe, and click Done.

After you close the dialog, the list shows only the token's Name and Created, and each row has Rename and Revoke. Revoke all appears below the list.

Revoke a token

If you no longer use a token or it has leaked, click Revoke on its row, then click Revoke in the Revoke “token name”? Anything using it loses access. dialog. In our test, calling the API again right away with the revoked token returned 401 (1 run).

The API docs say "GENERATE TOKEN under API Tokens in the organization's ACCOUNT," but on 2026-10-29 the screens were Settings → API tokens → Issue token, as above.

Authentication

Put the token in the header of every request.

Authorization: Bearer <token>

The API docs say a token acts as the organization's identity and sees only projects the organization owns, but in our tests a token issued in a personal workspace could read and write my personal projects. Calling with a project ID that doesn't exist returned 404 {"error":"Project not found"}. Assets are not branch-specific (API docs: branchId is accepted but ignored).

Errors

Error responses have the form { "error": "..." }.

Status	Message	Meaning
`401`	`Unauthorized`	The token is missing, wrong, or revoked (tested)
`403`	`Disk allowance exceeded`	You've exceeded the storage limit (Workspaces)
`404`	`Project not found`, `Project or Asset not found`	It doesn't exist, or you don't have permission to see it
`429`	`Too many requests`	You've exceeded the rate limit

Rate limits

There are three tiers of per-minute limits. Each endpoint's tier is listed in the Endpoint reference.

Tier	Per minute
`normal`	240
`strict`	10
`assets`	120

Check how much you have left with the response headers X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset. In our tests, calling the asset list and then the scene list returned X-RateLimit-Limit: 240, with X-RateLimit-Remaining dropping to 239 and then 238, and a PUT that replaces an asset file returned 120. GET /api/rest/ratelimits returns the per-minute limit for each tier: {"limits":{"normal":240,"strict":10,"assets":120}}. This was the only endpoint that returned 200 even without a token.

Example: a project's asset list

curl -H "Authorization: Bearer $OASISW_TOKEN" \
  "https://oasisw.ai/api/rest/projects/<project ID>/assets?limit=100"

The project ID is the first value in the editor URL oasisw.ai/editor/<project ID>/<scene ID>. The response in our test looked like this (values shortened):

{
  "result": [
    { "id": "…", "name": "playHit.js", "type": "script", "state": "ready",
      "preload": true, "file": { … }, "parent": … , … }
  ],
  "pagination": { "skip": 0, "limit": 16, "total": 14 }
}

If you don't pass limit, results come 16 at a time. Check pagination.total for the total count.

Next steps

Endpoint reference