Prepare an AI Studio API call

Prepare the following information before calling AI Studio in a workspace:

For the complete endpoint list and request details, see AI Studio.

1. Create a personal access token

Create a personal access token in Access credentials, and copy its complete value after creation.

2. Get a workspace ID

AI Studio API features must be used in a workspace. Before using workflows, knowledge bases, data, agents, or other features, select the target workspace and get its workspace ID.

Select the target workspace in the console workspace panel, then copy its workspace ID. You can also use the following API to list the workspaces available to the current identity:

export AI_STUDIO_API_KEY='<your-personal-access-token>'

curl --get "https://api.moi.matrixorigin.cn/v5/workspaces" \
  -H "X-API-Key: $AI_STUDIO_API_KEY"

Select the target workspace from data.workspaces[].id, then save its ID as an environment variable:

export WORKSPACE_ID='<workspace-id-from-the-response>'

For the complete request parameters and response fields, see List workspaces.

3. Call example

This example calls the List workflows API. Use the personal access token and workspace ID from the previous steps to list the workflows that the current identity can read in the target workspace:

curl --get "https://api.moi.matrixorigin.cn/v5/workflow/v2/workflow-apps?offset=0&limit=20" \
  -H "X-API-Key: $AI_STUDIO_API_KEY" \
  -H "X-Workspace-ID: $WORKSPACE_ID"

A successful request returns 200. data.workflows contains the workflow list, and data.total is the total number of matching workflows. For the complete request parameters and response fields, see List workflows.

Troubleshoot failed calls

Check the headers actually sent before deciding whether to replace the token.

Symptom

Check and action

Sending a personal access token as Bearer reports an expired login session

Use X-API-Key and remove Authorization from that request. Keep X-Workspace-ID for workspace-scoped actions.

ErrApiKeyInvalid

Confirm that the full token is sent in X-API-Key, then check whether it expired, was disabled, or was rotated.

ErrMultipleAuthCredentials

Check for an API key combined with another authentication header or a product-session cookie. Keep one authentication method in the API-key request.

The first request succeeds and later requests report conflicting credentials

Check whether the client saves Set-Cookie and sends Cookie on later requests. Some deployments may also treat gateway cookies as a conflict. Use a dedicated API client, disable cookie storage and transmission for this request path, or clear its cookie jar before each request.

In Postman, check the target domain’s cookie jar and automatic cookie settings. With requests.Session, check both manually configured Cookie headers and stored session cookies. For browser API-key requests, confirm that the credentials setting does not attach login cookies. If requests still fail without cookies, record the HTTP status, response code, and request time and contact support.

Next steps

Last updated on