Developers
Every guardrail in the product is available to your code
Open a thread, stream a grounded answer, get the chart spec and the files back. The API enforces the same tiers as the interface, so an integration cannot be the way around them.
Keys are scoped to a workspace and inherit its access. A key cannot read a source the person who created it could not read, and every call is metered and written into the same audit log the interface writes to.
Ask a question
curl -X POST https://insighter.app/v1/threads/thr_8f2c41/messages \
-H "Authorization: Bearer $INSIGHTER_KEY" \
-H "Content-Type: application/json" \
-d '{
"message": "Why did gross margin dip in April?"
}'The reply streams back, and says what it cost
event: text
data: {"delta":"A one-off rebate accrual of ..."}
event: chart
data: {"spec":{"type":"bar","title":"Q2 margin bridge", ...}}
event: done
data: {"credits":38,"files":["margin-bridge.csv"]}Embedded
Ship an analyst inside your own product
Mint a short-lived scoped token carrying an end user's row filters. Insighter compiles those filters into every query as mandatory conditions, so neither the caller nor the model can widen them.
Scoped tokens
Fifteen-minute ceiling, minted by your backend, never by the browser.
Filters in the compiler
Row conditions are compiled in, not appended. A denied metric never appears at all.
Per-tenant metering
Credits attributed to the calling tenant, so you can rebill without reconciling anything.
Your data
Never used to train a model. Never sold. AES-256 at rest under a key derived per organization, so no other tenant's key opens yours, and no standing internal access to any of it.