API & docs

A familiar API. An unfamiliar guarantee.

The Sigmix API follows the request and response shapes your team already writes against, so most integrations are a base-URL change. What differs is where the call lands — your own sealed appliance, or in-Kingdom cloud that never leaves Saudi Arabia.

Quickstart Endpoints

// self-serve keys from the dashboard · same surface on every posture

curl
# the only thing that changes between postures is the base URL
curl https://api.sigmix.ai/v1/chat/completions \
  -H "Authorization: Bearer $SIGMIX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "sigmix-chat-standard",
    "messages": [
      {"role": "user", "content": "لخّص هذا التقرير"}
    ]
  }'
Built for your stack
Self-serve API keys Same surface, every posture Arabic + English Streaming supported Audit-anchored by default
Quickstart

Point it at the posture you bought.

One API surface across all deployments. Your code does not change when you move from a cloud trial to a sealed appliance — the base URL does, and that is the whole migration.

In-Kingdom cloud

KSA Cloud

https://api.sigmix.ai/v1

Oracle in-Kingdom regions. Elastic, managed, nothing crossing the border.

Your rack

On-prem appliance

https://sigmix.internal/v1

Resolves inside your own network. No outbound path exists to leave it.

The desk

Sigmix Zero

http://localhost:8443/v1

The device serves its own loopback endpoint. Works with the network unplugged.

Opt-in · not in-Kingdom

Global Cloud

https://api.sigmix.ai/v1

The only tier reaching frontier models — and the only one that is not sovereign. Labelled everywhere.

Authentication

Bearer keys, scoped and revocable.

Create keys yourself from the dashboard — no ticket, no sales call. Each key is scoped to a project, carries its own rate limit, and can be rotated or revoked without touching the others. Every call it makes is attributed to it in the audit log.

Keys are shown once at creation and stored hashed. If a key is lost it is rotated, not recovered — which is the behaviour your security team expects.
python
import os
from sigmix import Sigmix

client = Sigmix(
    api_key=os.environ["SIGMIX_API_KEY"],
    # swap this one line to move posture
    base_url="https://sigmix.internal/v1",
)

resp = client.chat.completions.create(
    model="sigmix-chat-standard",
    messages=[{"role": "user", "content": "Summarise Q3 revenue"}],
    stream=True,
)

for chunk in resp:
    print(chunk.choices[0].delta.content or "", end="")
Reference

Endpoints.

The core surface. Availability varies by posture — a sealed device reaches lower model tiers than a GPU rack, and the API reports what it can actually serve.

MethodPathWhat it does
POST/v1/chat/completionsChat and completion, streaming or buffered. Arabic and English.
POST/v1/embeddingsVector embeddings for your own retrieval pipelines.
POST/v1/documentsIngest a document into a knowledge base. Guard scrubs PII before indexing.
POST/v1/documents/queryRetrieval-augmented query against an indexed knowledge base.
POST/v1/images/generationsImage generation, where the posture has the compute for it.
POST/v1/audio/transcriptionsSpeech to text, Arabic and English.
GET/v1/modelsWhat this deployment can actually serve — not a global catalogue.
GET/v1/audit/anchorsRetrieve TPM-signed audit anchors for independent verification.
GET/v1/healthLiveness, model readiness and — on sealed postures — the egress counter.

// full reference, schemas and error codes live in the developer docs — link from your dashboard once you have a key

What a normal AI API doesn't give you

The sovereign parts.

Verifiable audit anchors

Every call is hashed into a chained anchor and TPM-signed. Pull them from /v1/audit/anchors and verify them yourself, off-box.

Scrubbing on the request path

National ID, Iqama, IBAN and card patterns are redacted before the model sees them — including through the API, not just the app.

Residency in the response

Every response carries the region it was served from. Your own logs can prove residency without taking our word for it.

Honest model listing

/v1/models returns what this deployment can serve. A sealed device will not advertise a frontier model it cannot run.

No training on your calls

API traffic is never used to train any model. On sealed postures the question is moot — nothing leaves to be trained on.

Portable by design

No proprietary lock-in in the wire format. If you outgrow us, your integration is a base URL away from something else.

Client libraries

Use ours, or the one you already have.

Because the surface is compatible, most existing clients work by pointing them at a Sigmix base URL. We also ship first-party SDKs where it saves you the boilerplate.

PyPythonpip install sigmix
JSNode / TypeScriptnpm i @sigmix/sdk
C#.NETdotnet add package Sigmix
GoGogo get sigmix.sa/go
{ }RESTany HTTP client
Rate limits

Bounded by your plan, or by your hardware.

On the cloud, limits are per key and per plan. On an appliance you own the compute, so the only ceiling is the box — we do not meter what is already yours.

PostureRequest limitNotes
KSA Cloud · standard60 req / min / keyBurst allowance above the sustained rate; 429 with Retry-After.
KSA Cloud · dedicatedby contractDedicated in-Kingdom GPU capacity for regulated clients.
On-prem applianceunmeteredBounded by your own hardware. We do not rate-limit a box you own.
Sigmix ZerounmeteredLocal loopback. Throughput is whatever the device sustains.
Questions

For developers

How compatible is "compatible"?
The core chat, embeddings and models surfaces follow the shapes most teams already write against, so existing clients generally work with a base-URL change. Sovereign-specific endpoints — audit anchors, residency headers, document ingest with scrubbing — are additions, not replacements, so nothing breaks if you ignore them.
Do I need a different key per posture?
Yes. A cloud key authenticates against the cloud; an appliance issues its own keys locally, because a sealed box cannot phone home to check one. That is a consequence of zero egress rather than a design preference.
Does the API work with no internet?
On the appliance and on Sigmix Zero, yes — the endpoint is inside your network or on the loopback interface. That is the point of those postures: the API is local, so it keeps working when the network does not.
Which models can I request?
Call /v1/models against the deployment you are pointed at. It returns what that box or region can actually serve rather than a global catalogue, so you never get a runtime failure from requesting something the hardware cannot run.
Is API traffic used for training?
No — not by us and not by a vendor behind us. There is no shared training pool. On sealed postures nothing leaves the building for it to be possible at all.
How do I verify an audit anchor?
Pull the anchor from /v1/audit/anchors, check the chain, and verify the TPM signature against the appliance's public key. The specification is in the evidence pack — see the Trust Center.
Start building

Get a key and make one call.

Start on the KSA Cloud during the trial, write your integration against it, then repoint the base URL when your appliance is racked. Same code, different building.

Try Workspace free Trust Center Talk to us
Service health and incident notices go to your technical account contact.