Get started: a key and a first call

The Videas public API lets a server of yours work with your organization’s library and its channels: read what the library holds — its assets and the workspaces they are filed in —, add files and videos hosted elsewhere to it, edit what is in it, and publish it on the organization’s channels. It answers at https://api.videas.com/v1, speaks JSON over HTTPS, and is described by an OpenAPI 3.1 contract, which the API reference renders and lets you download.

Three things to do, in this order: create a key, keep it on a server, and send it with every request.

Create a key

An owner or an administrator of the organization creates keys, in the Videas app:

1. Open Settings → API Access, then Create a key.
2. Key name: what the key is for — “CMS sync”, “LMS import” — so that it can be recognized in the list, and in the history of the assets it edits.
3. Expiration: no expiration, 30 days, 60 days, 90 days or one year. A key that expires on its own is one less forgotten secret.
4. What the key may do: tick the permissions the integration needs, and nothing more. The ones that read are ticked by default; the ones that write are unticked, so that a key that writes is always created on purpose.
5. Create the key, then Copy the key. Its full value, ak_…, is shown this once and cannot be read again: store it straight away. A key whose value was lost is revoked and replaced.

A key belongs to the organization, not to the person who created it. It keeps working when they leave, and everything it reaches is that one organization’s.

Its permissions

A key opens the API with the permissions it carries, and no other. It may carry seven, and each opens what it says:

• None implies another: a key made to publish cannot edit an asset, and a key made to edit cannot read the library. A write answers what it wrote whether or not the key may also read it.
• Three depend on what the organization uses. The two channel permissions open nothing for an organization that does not publish channels: every channel endpoint answers it 403, as it would a key without them. And assets.third_party_video.import opens nothing until Videas turns on videos hosted elsewhere for the organization: until then, POST /v1/assets answers 404. A key may carry either beforehand, and works with no change once the organization has the feature.
• A key with no permission opens nothing.

Keep it on a server

The key is a secret, like a password:

• keep it in a secrets manager or in an environment variable your server reads — never in a repository, a web page or an app you ship to your users;
• give each integration a key of its own, so that one can be revoked without touching the others;
• to revoke one, Revoke in the same screen: anything still using it stops authenticating at once.

A web page cannot call the API anyway: /v1 sends no CORS headers, so a browser refuses to hand a page its answers. To let your users send files from their browser, your server opens the upload and hands the page that upload’s own token, never the key — see Add a file with the API.

Send it with every request

The key goes in the Authorization header, as a Bearer token:

Authorization: Bearer ak_…

Without it, or with a key that is unknown, expired or revoked, the answer is a 401 with the code unauthorized. A key that does not carry the permission an endpoint requires gets a 403, forbidden.

Your first call

List the assets of your library:

export VIDEAS_API_KEY="ak_…"   # better: from your secrets manager

curl https://api.videas.com/v1/assets \
  -H "Authorization: Bearer $VIDEAS_API_KEY"

The answer is one page of assets, oldest first, and the cursor of the next page:

{
  "data": [
    {
      "id": "0192a6b2-4f1a-7b90-8e0d-51c3a7f2b046",
      "name": "Opening lecture",
      "type": "video",
      "status": "ready",
      "workspace_id": "0192a6b1-7c3e-7d40-9a51-3f0e2b6c8d10",
      "description": null,
      "external_ref": "course-42/lecture-1",
      "language": "en",
      "duration_ms": 2712000,
      "created_at": "2026-09-26T09:12:44Z",
      "updated_at": "2026-09-26T09:31:02Z",
      "third_party": null,
      "thumbnail_url": "https://app.videas.com/images/assets/0192a6b2-4f1a-7b90-8e0d-51c3a7f2b046/thumbnail.jpg"
    }
  ],
  "next": "MDE5MmE2YjItNGYxYS03Yjkw…"
}

The same call from Node.js (18 or later) and from Python, on your server:

const response = await fetch('https://api.videas.com/v1/assets', {
  headers: { Authorization: `Bearer ${process.env.VIDEAS_API_KEY}` },
})
const page = await response.json()
if (!response.ok) throw new Error(`${page.code}: ${page.message}`)
console.log(page.data.length, 'assets on this page')

import os

import requests

response = requests.get(
    "https://api.videas.com/v1/assets",
    headers={"Authorization": f"Bearer {os.environ['VIDEAS_API_KEY']}"},
)
response.raise_for_status()
page = response.json()
print(len(page["data"]), "assets on this page")

A 403 here means the key cannot read the library: create one with Read the library through the API ticked.

What the API does

The library

Adding to it

Editing an asset

The channels

What was watched

New resources land under /v1 without changing what is already there — Errors, limits and versions says what may change and what may not.

Next steps

• Read the library — filters, pages, counts, one asset, the workspaces.
• Add a file with the API, from a link, or a video hosted elsewhere.
• Edit an asset, its custom fields and its thumbnail.
• Publish on a channel.
• Errors, limits and versions — what to do with each refusal.
• The API reference: every endpoint, field and error, generated from the contract.