Overview

The MnemonX API lets AI tools, personal apps, and scripts read and write a user's memory wallet — a structured, encrypted store of personal context: domains of knowledge, professional background, preferences, and more. All data is AES-256-GCM encrypted client-side before storage. The server never sees plaintext.

Base URL

https://mnemonx.ai

Protocol

HTTPS only

Format

JSON (UTF-8)

Encryption notice

Domain values are encrypted with a per-user key derived from the user's password (PBKDF2 + AES-256-GCM). API responses return the encrypted ciphertext. AI tools that receive memory via OAuth receive pre-decrypted plaintext — decryption happens server-side using the user's stored key material.

Authentication

All API requests must include an Authorization header. Two credential types are supported:

API Keys (personal access)

Generate API keys from the Wallet → API tab. Keys are prefixed mnx_live_ and grant access to your own wallet only. Available on Premium, Team, and Enterprise plans.

# Pass the key as a Bearer token
curl https://mnemonx.ai/api/v1/context \
  -H "Authorization: Bearer mnx_live_your_key_here"
Authorizationheaderrequired

Format: "Bearer mnx_live_..." — include on every request.

OAuth Access Tokens (third-party apps)

OAuth tokens are issued after a user authorizes your app (see OAuth section). Tokens look like mxa_xxxxxxxxxxxxxxxxxxxx and are scoped to specific permissions granted by the user.

curl https://mnemonx.ai/api/v1/memory \
  -H "Authorization: Bearer mxa_xxxxxxxxxxxxxxxxxxxx"

Rate Limits

API access itself is a Premium, Team, or Enterprise feature — Free and Pro accounts can't generate an API key at all, so there's no rate limit to speak of on those plans. For tiers that do have access, every rule below is a base limit multiplied by your plan (Premium 8×, Team 15×, Enterprise unlimited).

Exceeded requests return 429 Too Many Requests with a Retry-After header (seconds).

EndpointBase (Free/Pro)Premium (8×)Team (15×)Enterprise
GET /api/v1/memory, /api/v1/context (reads)No access480/min900/minUnlimited
POST /api/v1/memory (writes)No access80/min150/minUnlimited
POST /api/v1/memory/searchNo access240/min450/minUnlimited
OAuth token exchange (/api/oauth/token)10/min10/min10/min10/min

Rate limit headers are returned on every response: X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset.

Memory API

The Memory API gives programmatic read/write access to a user's wallet domains. Requires memory.read or memory.write scope. Available on Pro and Premium plans.

Read memory

GET/api/v1/memory

Query Parameters

formatstring

"json" (default) returns structured array. "text" returns a flat context block for pasting into system prompts.

domainsstring

Filter to specific domain IDs, comma-separated. Returns all domains if omitted.

include_metadataboolean

If true, includes version history counts and last-modified timestamps per domain.

# Return all domains as structured JSON
curl https://mnemonx.ai/api/v1/memory \
  -H "Authorization: Bearer mnx_live_your_key"

# Return as plain text (ready for AI system prompt)
curl "https://mnemonx.ai/api/v1/memory?format=text" \
  -H "Authorization: Bearer mnx_live_your_key"

# Filter to specific domains
curl "https://mnemonx.ai/api/v1/memory?domains=tech,finance" \
  -H "Authorization: Bearer mnx_live_your_key"

Response (JSON)

{
  "domains": [
    {
      "id": "tech",
      "name": "Technology",
      "value": "Senior software engineer...",
      "context": "Expert in TypeScript, React, Next.js...",
      "order": 0
    }
  ],
  "wallet_name": "My Wallet",
  "total_domains": 12,
  "generated_at": "2026-06-13T12:00:00Z"
}

Write memory

POST/api/v1/memory

Update one or more domain values. Every write creates a version history entry (full audit trail). Requires memory.write scope.

Request Body

domainsarrayrequired

Array of domain update objects. Each must have id and at least one of: value, name, context.

sourcestring

Optional label for the version history entry (e.g. "chatgpt-plugin", "my-app"). Default: "api".

curl -X POST https://mnemonx.ai/api/v1/memory \
  -H "Authorization: Bearer mxa_xxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "domains": [
      {
        "id": "tech",
        "value": "Principal engineer with 10 years TypeScript experience",
        "context": "Currently building MnemonX — AI memory infrastructure"
      }
    ],
    "source": "my-ai-tool"
  }'

Response

{
  "success": true,
  "updated": 1,
  "version_id": "vhst_xxxxxxxxxxxxxxxx",
  "timestamp": "2026-06-13T12:00:00Z"
}

Context API

The Context API returns a pre-formatted context block ready to insert into any AI system prompt. Requires read:context scope. Available to Premium users.

Get context

GET/api/v1/context
domainsstring

Comma-separated domain IDs to include. Returns all if omitted.

formatstring

"json" (default) or "text". Text returns a plain neural context block.

# JSON (structured)
curl https://mnemonx.ai/api/v1/context \
  -H "Authorization: Bearer mnx_live_your_api_key"

# Plain text — paste directly into a system prompt
curl "https://mnemonx.ai/api/v1/context?format=text" \
  -H "Authorization: Bearer mnx_live_your_api_key"

Example text output

[CONTEXT: MnemonX User Profile]
Name: Alex Chen
Technology: Principal engineer, 10y TypeScript, React, Node.js
Finance: Long-term investor, ETF focused, risk-averse
Languages: English (native), Mandarin (conversational)
[END CONTEXT]

OAuth Flow

MnemonX implements OAuth 2.0 Authorization Code flow. Register your app, redirect users to authorize, exchange the code for tokens, and call the API on their behalf. Users can revoke access at any time from Wallet → Apps.

1 · Register your app

App registration is currently invite-only. Email [email protected] with your app name, website, and intended scopes to receive your credentials.

client_idstring

Public identifier for your app. Safe to include in client-side code.

client_secretstring

Secret for server-to-server token exchange only. Never expose in browser or mobile code.

redirect_uristring

Callback URL registered for your app. Must match exactly on every request (no trailing slashes, no params).

2 · Redirect to authorize

Redirect the user to the MnemonX consent screen:

GET https://mnemonx.ai/authorize
  ?client_id=YOUR_CLIENT_ID
  &redirect_uri=https://yourapp.com/callback
  &response_type=code
  &scope=memory.read memory.write
  &state=random_csrf_token
client_idstringrequired

Your registered client ID.

redirect_uristringrequired

Must match your registered callback URL exactly.

response_typestringrequired

Must be "code".

scopestringrequired

Space-separated scopes. See Scopes Reference.

statestring

Strongly recommended. Random string to prevent CSRF. Verify on callback.

Users can restrict scopes to specific domains on the consent screen (e.g. grant memory.read:personal instead of all-domain memory.read).

3 · Exchange code for tokens

After the user approves, MnemonX redirects to your redirect_uri with a short-lived code. Exchange it server-side within 10 minutes:

curl -X POST https://mnemonx.ai/api/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "authorization_code",
    "code": "AUTH_CODE_FROM_CALLBACK",
    "redirect_uri": "https://yourapp.com/callback",
    "client_id": "YOUR_CLIENT_ID",
    "client_secret": "YOUR_CLIENT_SECRET"
  }'

Response

{
  "access_token":  "mxa_xxxxxxxxxxxxxxxxxxxx",
  "token_type":    "Bearer",
  "expires_in":    86400,
  "refresh_token": "mxr_xxxxxxxxxxxxxxxxxxxx",
  "scope":         "memory.read memory.write"
}

4 · Refresh access tokens

Access tokens expire after 24 hours. Use the refresh token (valid 30 days) to get a new pair:

curl -X POST https://mnemonx.ai/api/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type":    "refresh_token",
    "refresh_token": "mxr_xxxxxxxxxxxxxxxxxxxx",
    "client_id":     "YOUR_CLIENT_ID",
    "client_secret": "YOUR_CLIENT_SECRET"
  }'

5 · Revoke access

Users can revoke from the app UI. Your app can also revoke programmatically (e.g. on logout):

curl -X DELETE https://mnemonx.ai/api/oauth/revoke \
  -H "Authorization: Bearer mxa_xxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{ "token": "mxa_xxxxxxxxxxxxxxxxxxxx" }'

After revocation, all subsequent API calls with this token return 401 Unauthorized. Access and refresh tokens are both invalidated atomically.

Scopes Reference

Scopes are requested during the OAuth flow. Users must explicitly grant each scope. Narrower scopes (domain-filtered) improve user trust and are recommended.

ScopeAccessNotes
memory.readRead all domainsReturns domain names, values, and context.
memory.writeWrite all domainsCreate or update domain values. Always creates a version history entry.
memory.searchSearch within domainsFull-text search across domain values.
memory.read:<id>Read one domaine.g. memory.read:tech — user can scope access to a single domain.
memory.write:<id>Write one domaine.g. memory.write:finance — write-access limited to one domain.
read:contextRead pre-formatted contextReturns the full formatted context block. Premium only.
profile.readRead profile metadataUser name, tier, wallet count. No domain values.

Principle of least privilege: Request only the scopes you need. Users are more likely to approve narrowly-scoped requests. Audit logs capture every scope grant and use.

Error Codes

All errors return a JSON body with error (machine-readable code) and message (human-readable description).

{
  "error":   "invalid_token",
  "message": "The access token has expired. Refresh using your refresh token."
}
HTTPError codeDescription
400invalid_requestMissing required parameter or malformed JSON body.
401unauthorizedNo Authorization header provided.
401invalid_tokenToken is malformed, expired, or revoked.
403insufficient_scopeToken lacks required scope for this operation.
403plan_requiredThis endpoint requires a higher plan (Pro or Premium).
404not_foundRequested resource or domain does not exist.
409conflictConflicting write — another update was made concurrently. Retry.
422domain_too_largeDomain value exceeds per-domain size limit for your plan.
429rate_limitedRate limit exceeded. See Retry-After header.
500internal_errorUnexpected server error. Retry after a short delay.
503service_unavailablePlanned maintenance or overload. See status.mnemonx.ai.

SDKs & Examples

Official SDKs are in development. Use the REST API directly in the meantime — it works with any HTTP client.

JavaScript / TypeScript

// Fetch user context and inject into a system prompt
const res = await fetch('https://mnemonx.ai/api/v1/context?format=text', {
  headers: { Authorization: `Bearer ${process.env.MNEMONX_API_KEY}` },
})
const context = await res.text()

const completion = await openai.chat.completions.create({
  model: 'gpt-4o',
  messages: [
    { role: 'system', content: `You are a helpful assistant.\n\n${context}` },
    { role: 'user',   content: userMessage },
  ],
})

Python

import os, requests

MNEMONX_KEY = os.environ["MNEMONX_API_KEY"]
BASE = "https://mnemonx.ai"

def get_context(format="text"):
    r = requests.get(
        f"{BASE}/api/v1/context",
        params={"format": format},
        headers={"Authorization": f"Bearer {MNEMONX_KEY}"},
    )
    r.raise_for_status()
    return r.text if format == "text" else r.json()

def update_domain(domain_id: str, value: str, source="my-app"):
    r = requests.post(
        f"{BASE}/api/v1/memory",
        json={"domains": [{"id": domain_id, "value": value}], "source": source},
        headers={"Authorization": f"Bearer {MNEMONX_KEY}"},
    )
    r.raise_for_status()
    return r.json()

Shell / cURL quick reference

BASE="https://mnemonx.ai"
KEY="mnx_live_your_key_here"

# Read all domains (JSON)
curl "$BASE/api/v1/memory" -H "Authorization: Bearer $KEY"

# Read as plain text (for system prompt)
curl "$BASE/api/v1/context?format=text" -H "Authorization: Bearer $KEY"

# Write a domain
curl -X POST "$BASE/api/v1/memory" \
  -H "Authorization: Bearer $KEY" \
  -H "Content-Type: application/json" \
  -d '{"domains":[{"id":"tech","value":"Expert in TypeScript and React"}]}'

# Revoke an OAuth token
curl -X DELETE "$BASE/api/oauth/revoke" \
  -H "Authorization: Bearer mxa_xxxx" \
  -d '{"token":"mxa_xxxx"}'

Webhooks

MnemonX can push real-time notifications to your server whenever a user's wallet changes. Register a webhook endpoint to receive events without polling.

Register a webhook

Webhook endpoints are registered per OAuth client, authenticated with the OAuth access token issued to your app after a user completes the authorize flow — not your personal mnx_live_ API key, which is scoped to your own wallet only, not to an OAuth client.

POST https://mnemonx.ai/api/webhooks
Authorization: Bearer <oauth_access_token>
Content-Type: application/json

{
  "url":    "https://your-app.com/webhooks/mnemonx",
  "events": ["memory.update", "user.revoke"]
}
urlstringrequired

HTTPS endpoint that will receive POST requests (HTTP allowed only in local dev).

eventsstring[]required

Event types to subscribe to — only "memory.update" and "user.revoke" are currently supported.

The signing secret is generated by the server and returned once in the response — you don\'t choose or send your own:

{
  "webhook": { "id": "wh_xxxx", "url": "https://your-app.com/webhooks/mnemonx", "events": ["memory.update", "user.revoke"], "is_active": true, "created_at": "2026-06-22T14:30:00Z" },
  "secret":  "whsec_...",
  "note":    "Save the secret now — it will not be shown again."
}

Max 5 active endpoints per app.

Event types

EventWhen fired
memory.updateYour app wrote to the user's wallet (via the memory API)
user.revokeUser disconnected/revoked your app's access

Payload format

{
  "event":     "memory.update",
  "timestamp": "2026-06-22T14:30:00Z",
  "data": {
    "user_id":   "usr_xxxx",
    "domain_id": "coding",
    "source":    "api"
  }
}

Verifying signatures

Every delivery includes an X-MnemonX-Event header (the event type) and an X-MnemonX-Sig-256 header. Verify the signature to confirm the request is genuine:

// Node.js / TypeScript
import { createHmac } from 'crypto'

function verifyWebhook(
  payload: string,          // raw request body as string
  signature: string,        // X-MnemonX-Sig-256 header value
  secret: string
): boolean {
  const expected = createHmac('sha256', secret)
    .update(payload)
    .digest('hex')
  return `sha256=${expected}` === signature
}

// Express example
app.post('/webhooks/mnemonx', express.raw({ type: '*/*' }), (req, res) => {
  const sig = req.headers['x-mnemonx-sig-256'] as string
  if (!verifyWebhook(req.body.toString(), sig, process.env.WEBHOOK_SECRET!)) {
    return res.status(401).send('Invalid signature')
  }
  const event = JSON.parse(req.body)
  // handle event...
  res.sendStatus(200)
})

Delivery guarantees

Each event is delivered with a single POST attempt — there is no automatic retry yet if your endpoint is down or returns a non-2xx status. Build your handler to be idempotent and keep it fast and reliable; a retry/redelivery mechanism is on our roadmap but not live today.

Data Residency

MnemonX routes every API request to the user's assigned regional database. Encrypted wallet data never crosses regional boundaries. Your API responses include a X-MNX-Region header on every response.

RegionX-MNX-RegionDB LocationStatus
🇺🇸 United StatesusSupabase us-east-1 (Virginia)Live
🇪🇺 European UnioneuSupabase eu-central-1 (Frankfurt)Live · GDPR
🇦🇺 Australia & Pacificapac— (coming soon)Pipeline
🇸🇬 Southeast Asiasea— (coming soon)Pipeline
🇧🇷 South Americalatam— (coming soon)Pipeline

X-MNX-Region response header

Every authenticated API response includes the X-MNX-Region header. Use this to verify the data was served from the expected region, and to enforce your own compliance policies.

HTTP/2 200 OK
Content-Type: application/json
X-MNX-Region: eu
X-MNX-Request-Id: req_01HZ9KXMR7V8A2T

{
  "domain": "work",
  "fields": { ... }
}

If you are building a GDPR-compliant integration, you should verify that EU users always receive X-MNX-Region: eu. Contact [email protected] if a user reports receiving an unexpected region.

API base URL

The MnemonX API uses a single base URL. Regional routing is transparent — the edge function reads the user's mnx_region from their account and connects to the correct Supabase project automatically.

# Single base URL — routing is automatic
BASE_URL=https://mnemonx.ai

# All API calls use the same base regardless of region
curl $BASE_URL/api/v1/memory   -H "Authorization: Bearer $ACCESS_TOKEN"
# Response: X-MNX-Region: eu  (for EU users)
# Response: X-MNX-Region: us  (for US users)

Compliance & Privacy

MnemonX is built privacy-first. This section summarises what that means for your integration.

GDPR — API as data processor

Roles

When your application reads or writes to a user's wallet via the API, your app is the data controller for how you use that data. MnemonX is the data processor (GDPR Art. 28). Our DPA governs this relationship.

What we guarantee

  • EU user data stays in eu-central-1 — never transferred to US infrastructure.
  • All wallet data is AES-256-GCM encrypted at rest and decrypted only to serve your authorized request — MnemonX does not read or retain the content you retrieve.
  • Access logged for 90 days — users can request their full API access log via GDPR export.
  • Token revocation is instantaneous — when a user disconnects your app, your token is invalidated server-side immediately.
  • No advertising or profiling from API data — we have no business model that involves monetising wallet content.

Your obligations as controller

  • Request only the scopes you actually use — principle of data minimisation (GDPR Art. 5(1)(c)).
  • Delete wallet data you have stored when a user exercises their right to erasure.
  • Include MnemonX as a data source in your Privacy Policy.
  • Do not store decrypted wallet content longer than necessary for the stated purpose.

CCPA — Service Provider terms

MnemonX qualifies as a Service Provider under CCPA §1798.140(ag). We: (a) process personal information only for specified business purposes; (b) do not sell or share personal information retrieved from the API; (c) do not retain, use, or disclose wallet data outside the service relationship. California-based developers should disclose MnemonX as a Service Provider in their privacy disclosures.

Scope minimisation best practice

Request the minimum scopes required for your use case. The table below shows scope granularity:

Your use caseRecommended scopeAvoid
Read work context onlymemory.read:workmemory.read (all domains)
Personalise AI responsesmemory.read:personal + memory.read:workmemory.read
Write AI memoriesmemory.write:[domain]memory.write (all domains)
Search walletmemory.search
Full integrationmemory.read + memory.writeUse only when truly needed

Changelog

July 2026

v1.4
  • SECURITY: /api/oauth/token now actually verifies client_secret on every exchange (previously accepted but not checked — always send it, per the docs above, and this now matters).
  • grant_type=refresh_token is now fully functional with refresh-token rotation (previously documented but not implemented — tokens issued before this date could not be refreshed and required a fresh consent flow).
  • SCIM 2.0 provisioning for Enterprise orgs (not a public developer API — see your org Security tab).

June 2026

v1.3
  • Added POST /api/v1/memory — programmatic domain writes with version history
  • OAuth revoke endpoint (DELETE /api/oauth/revoke) — revokes both access and refresh tokens
  • OAuth token refresh flow (grant_type: refresh_token)
  • Granular domain-level scopes: memory.read:<id>, memory.write:<id>
  • Push notification triggers on OAuth grant and revocation
  • GDPR data export: GET /api/v1/user/export
  • Audit log for all API access (api_access_logs table)

April 2026

v1.2
  • OAuth 2.0 Authorization Code flow (authorize, token)
  • Consent audit log — SMS, email, and push opt-in/opt-out timestamps
  • Rate limiting on all endpoints
  • Prompt injection safeguards (8-pattern sanitizer)

February 2026

v1.1
  • GET /api/v1/context — plain-text system prompt injection
  • API key management in wallet UI
  • Version history on all domain writes
  • AES-256-GCM client-side encryption

December 2025

v1.0
  • Initial API release
  • GET /api/v1/memory — read domain wallet
  • Bearer token authentication (API keys)
  • Basic rate limiting

Coming soon

  • Webhook system — real-time events when domains are updated or OAuth granted
  • OAuth app self-registration portal (currently invite-only)
  • Official JavaScript and Python SDKs
  • Direct integration with ChatGPT memory (pending OpenAI API availability)
MnemonX API Reference · v1[email protected]
MnemonX — Your AI Memory, Everywhere