Fundamental Concepts
MIOSA is a cloud platform for building and deploying applications. Before writing your first API call, read this page. It covers the concepts that underpin every MIOSA integration.
This page is the API protocol reference: authentication, tokens, idempotency, rate limits, errors, events, and tenant-level configuration. For the resource model - what the resources are and how they relate - see Core Concepts.
What every integration needs
| Topic | Read |
|---|---|
| API keys, browser tokens, and the five token types | Authentication |
| Mapping resources to your own customers | Ownership and external attribution |
| Safe retries, quotas, and error handling | Requests, limits, and errors |
| Streaming progress over SSE | Events (SSE) |
| Webhooks and per-end-user quotas | Tenant configuration |
Where resources live
This page covers the API protocol. The full resource model - the ownership chain, the development and production resources, and how they relate - lives in Core Concepts.
In short: your account is one organization (a permanent slug, one billing account, and API keys). Inside it, workspaces separate customers, clients, teams, or environments, and projects group the resources for one product. Sandboxes, Computers, Deployments, Databases, Domains, Storage, Volumes, Functions, and Jobs belong to a project. Every request resolves one unambiguous organization, workspace, and project.
Sandboxes vs Computers
Sandboxes and Computers are two different products with different lifecycles and different use cases. The comparison table and the resource-model context live in Core Concepts.
- Use a Sandbox when the agent needs to write code, run shell commands, manage files, or serve a dev server.
- Use a Computer when the agent needs to operate a graphical interface - a browser, a desktop app, or anything with a visible screen.
Both products live in the same organization, can be separated by workspace/project, and appear on the same billing account.
Ownership and external attribution now lives in Ownership and external attribution.
Next
API key formats, browser tokens, and the five token types with their trust levels.
Canonical ownership fields, external attribution, and usage rollup for platforms.
Idempotency keys, rate limits, and the error envelope with HTTP status codes.
Stream progress with one-time tickets, resource streams, and the tenant-wide stream.
Webhook subscriptions and per-end-user quotas for white-label integrators.