# Basics

- **Transport:** JSON over HTTPS. Requests are POST; some routes also have a GET or DELETE form (e.g. `GET /v1/jobs/{id}`, `DELETE /v1/memories/{id}`). The body is at most **2 MB** (larger: `413`).
- **Authentication:** `Authorization: Bearer <credential>`.
  - **API keys** (`prism_...`) are for your servers. A key has scopes: `read`, `write`, `delete`, `admin`, `import`.
  - **User tokens** (`pt_...`) are for code running on a user's device. A token lasts at most 1 hour, may use only the memory spaces named in it, and reads as its own user. Your server issues them through `POST /v1/admin/tokens`.
- **Memory spaces:** `user` names a memory space (one per person, team or agent). A space belongs to your account only. Another account's space of the same name is a different space.
- **Every response** carries:
  - `X-Request-Id` (quote it when you report a problem);
  - `X-Prism-Credits-Left` (your credits after this call), once your key, token or Console session is accepted: not on a `401`, or on a request refused before that (a body over 2 MB: `413`).