Skip to main content

REST API

Everything the Fused Python SDK does happens over a REST API. That means you don't need Python to work with Fused — any language or tool that can make an HTTP request can call your UDFs and automate the platform.

This page explains the two API surfaces and how to authenticate against each. For the endpoints themselves — paths, parameters, and responses — see the REST API reference.

There are two distinct API surfaces, with different base URLs and different authentication:

SurfaceBase URLWhat it's forAuthentication
UDF endpointshttps://udf.aiCalling shared UDFs and getting data backCanvas token in the path; session token for team-only canvases
Platform APIhttps://www.fused.io/server/v1Everything else: session tokens, cache, the operations behind the SDKAuthorization header (bearer or service account)

UDF endpoints​

Every UDF on a shared canvas is an HTTP endpoint. The canvas token (fc_…) goes in the path, the UDF name and output format follow, and UDF parameters are query parameters:

https://udf.ai/fc_<CANVAS_TOKEN>/<udf_name>.json?param=value
  • UDFs as API — URL structure, output formats (.json, .csv, .parquet, .png, tiles, …), and parameters
  • Tokens & endpoints — sharing a canvas and getting its token

Access depends on how the canvas is shared. A public canvas needs no authentication (optionally gated by a canvas passcode). A team-only canvas requires a short-lived session token passed as the fused_session_token query parameter — see Securing Shared Tokens.

Platform API​

The platform API at https://www.fused.io/server/v1 is what the Python SDK and Workbench call under the hood. Use it directly when your caller isn't Python — a backend in another language, a CI/CD job, or a plain curl.

Requests authenticate with an Authorization header, in one of two forms:

Authorization: Bearer <access_token>
Authorization: Fused-Service-Token <service_account_token>
  • Bearer token — a personal access token that acts as you. Get one from an authenticated SDK session with fused.api.access_token(). Personal tokens expire with your session, so they suit interactive use and short-lived scripts.
  • Service account token — a long-lived machine credential that acts as your team's environment, made for automation. See Service Accounts for creating one and using it.

Some operations are user-scoped and accept only a personal bearer token — creating or updating canvases, for example. A service account covers environment-scoped operations such as running UDFs, minting session tokens, and invalidating caches.

The REST API reference documents which credentials each endpoint accepts, alongside its parameters and responses.

See also​