Skip to main content

​
EvalGate REST API overview

Everything you need to call the EvalGate REST API: base URL, authentication, response format, error envelope, versioning, and available endpoint groups.
The EvalGate REST API gives you programmatic access to evaluations, traces, LLM judges, human annotation tasks, and the authenticated Tool API. Every request goes to a single base URL and returns JSON. Most REST surfaces use camelCase field names. The trace collector (POST /api/collector and /api/collector/batch) is the documented exception and accepts snake_case wire fields such as trace_id and duration_ms. Prefer a typed client from the TypeScript SDK or Python SDK when you want retries, batching, and caching on top.

​
Base URL

All endpoints are served from:

​
Authentication

Customer-data operations require a bearer token in the Authorization header:
Get your API key from Settings → API keys in the EvalGate app. See API authentication for the full details, including scope errors and the organization ID environment variable. To exercise deterministic assertions before connecting customer data, use the credential-free API test mode. It saves no evaluation results, invokes no model provider and creates no billable result.

​
Response format

All responses are JSON. Field names use camelCase on the general REST API. Scope snake_case request fields to /api/collector (and its batch route); see Traces API. Example camelCase resource payload:

​
Standard error envelope

All error responses use this shape, regardless of status code:
The requestId field is a UUID you can include in support tickets to help the team locate the exact request. It also appears in the x-request-id response header. See API error codes for the full list of codes, HTTP status mappings, and error-handling examples.

​
Versioning

The error envelope and all documented response shapes are stable. Breaking changes are versioned and announced before they take effect — you will not encounter silent field removals or type changes on existing endpoints.

​
Endpoint groups

​
Rate limits

Default limits depend on the request context; individual routes can apply their own tier: Responses that reach rate-limit admission include RateLimit-Policy, RateLimit, numeric RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, and legacy X-RateLimit-* fields. RateLimit-Reset is a delay in seconds; X-RateLimit-Reset remains a Unix timestamp in milliseconds. Throttled admission returns 429, error code RATE_LIMITED, and Retry-After seconds. Infrastructure health checks have no request quota; shared-cacheable public responses omit per-caller quota hints. See Rate limits.

​
SDK alternative

If you are working in TypeScript or Python, the SDKs handle auth, retries, and batching automatically: