CometAI API - Getting Started

This article explains how to access & use the CometAI API Feature. It covers the three types of API keys available in CometAI - Owner Keys, System Keys, and Delegate Keys - including their purpose, when to use each key type, and best practices for selecting the appropriate key based on your use case.

Table of Contents

• Context
• Quick Start & Base Configuration 
• User-Facing Endpoints 
• API Key Access – How to get an API Key? 
  • Key Types
  • Rate Limits
  • Access Controls
  • Manage API Keys (Rotate/Deactivate)
• Creating a Delegate Key
• Receiving a Delegate API Key
• Billing & Cost

Context

This article explains how to access & use the CometAI API Feature. It covers the three types of API keys available in CometAI - Owner Keys, System Keys, and Delegate Keys - including their purpose, when to use each key type, and best practices for selecting the appropriate key based on your use case.

Quick Start & Base Configuration 

To ensure seamless integration testing, developers must configure their environments using the following standardized parameters: 

• Base URL Setup: https://api.cometai.utdallas.edu 
• Authentication Type: Bearer Token 
• Authorization Header Key: Authorization 
• Authorization Header Value: Bearer comet-token-<your-key-here> 

User-Facing Endpoints 

Designed for general developers, integration agents, and client-facing interfaces. These APIs facilitate core session execution, model capability discovery, asset uploads, and tag curation. 

• Model Queries: /available_models (GET) 
• Core Conversations: /chat (POST) 
• Ingestion Pipeline: /files/upload (POST) 
• Catalog Lookups: /files/query (POST) 
• Tag Directory: /files/tags/list (GET) 
• Tag Generation: /files/tags/create (POST) 
• Tag Purging: /files/tags/delete (POST) 
• Asset Assignment: /files/set_tags (POST) 
• Assistant Inventory: /assistant/list (GET) 
• Assistant Provisioning: /assistant/create (POST) 
• Assistant Sharing: /assistant/share (POST) 
• Assistant Deletion: /assistant/delete (POST) 

API Key Access – How to get an API Key? 

Step 1: ​​​​​​

• Login into CometAI at cometai.utdallas.edu 
• On the Main Page, click on the Settings tab (Paintbrush-icon) on the top-left of the window and click on Settings (gear-icon)

Step 2: 

• Click on Manage Accounts 

• Then go to Accounts Tab, and create a Billing account with an Account name (String) , Random COA String (numerical)  & a Monthly Cost Rate Limit for that Billing Account. Remember this COA String is internal for you to segrate your billings and have it show up in your Month to Date Cost Breakdown. 

• Then click the “+” icon to “Add Account”  and click “Save Changes” 

Disclaimer:

Setting a rate limit on a billing account establishes the maximum amount that can be spent using that account. Billing accounts can be attached to API keys for separate cost tracking and can also be designated as your default billing account, allowing both API and CometAI UI usage to be billed against the same account. 

If a billing account reaches its configured spending limit, access to paid models will be restricted until the next monthly billing cycle. However, you will continue to have access to ASPIRE models and can keep using CometAI.

The General Account has no user-configured spending limit, but usage remains subject to the maximum university-provided allocation and any additional quota that has been granted to you. Once that allocation is exhausted, access to paid models will be temporarily restricted until the monthly reset.

Naming rules:
Do not put NetID or email in Account Name or COA String / Account ID. Use only an integer Account ID (for example, a numeric project/COA code).

NOTE: API keys cannot be created against the built-in No COA On File account. Create a valid COA account first.

Step 3: ​​​​​​

• Go to the API Access Tab 
• Click “+ Create API Key” 
• For “Application Name”, give your preferred name which is easy to remember and add a short “Application Description” 
• Select Bill to “any of the Billing Account you created above”.
• Good Practice: Keep: Rate Limit as “Monthly” and “$5.00”, and set “Expiration Date” for 2-3 days.
• Toggle the “Access Controls” tab for giving specific access permissions.  (Description oof Access Controls is mentioned below).
• Click “+ Create Key” to create the API key 
• IMPORTANT:  
  • Never share your API key with anyone.  
  • If your API key gets leaked or lost, always create a new one. Delete or rotate the old key 
  • Save your API key in a safe document on your computer so it doesn’t get lost. 

Key Types

Rate Limits

Limits are checked in this order:

1. API Rate Limit – limit set on the individual API key by the user.

2. Account Rate Limit – limit on the billing account the key is billed to and it is set up by the user.

3. Global Limit – platform monthly cap (currently $5, unless extended access is enabled)

The first limit that is exceeded, blocks further usage. The rate limit you set on a key applies to that key (Owner, System, or Delegate). Effective limits also depend on the key’s permission / access level and account settings.

NOTE: Extended access above the global $5 limit is coming soon.

Access Controls

Access Controls define which CometAI API capabilities the key may use. Default is Full Access.

Control	Meaning
Full Access	All API capabilities below (default)
Chat	Call conversation / chat endpoints
Assistants	Create, list, share, or manage assistants via API
File Upload	Upload and work with files through the API
Share	Sharing-related API actions
Dual Embedding	Dual embedding / related embedding features

Use the minimum permissions needed for the integration. Tighter controls reduce risk if a key is exposed.

Manage API Keys (Rotate / Deactivate)

There is no separate “delete key” action in API Access. Use rotate or deactivate instead.

Rotate Key

1. Open API Access → expand the key → Key Management.

2. Click Rotate Key and confirm.

3. Copy the new key (shown once). The old key stops working; settings (account, limits, access) are preserved but are of no use as API key has stopped working.

Use rotate if a key is lost, leaked, or you need a fresh secret without recreating the key setup. Delegates must rotate a new Delegate Key before first use.

Deactivate (make inactive)

1. On an active key, click the green Active badge.
2. Confirm deactivation.

The key becomes Inactive and can no longer be used. Deactivation cannot be undone — create a new key if you need access again.

Creating a Delegate Key

On the API Access Tab, click on the + Add Delegate button and enter the NETID@utdallas.edu email of the user you want to share/delegate the key to.

Receiving a Delegate API Key

On the API Access Tab, scroll down and find the  Delegated API Keys section, click on the Rotate Key button to start using the key.

Billing & Cost

• If someone uses a Delegate Key you created, the key usage increases MTD cost fo the sending as well as the receiving user.
• Track spend for your accounts and API keys in Cost Breakdown (User menu → Month-To-Date Cost → View breakdown).