Programmatic access to Nucleus OS through a GraphQL API, plus a small number of REST endpoints for file uploads.

Nucleus OS exposes a GraphQL API for programs, learners, and results, and a small number of REST endpoints where a request carries a file upload. The web app uses the same API.

Endpoints

API	Endpoint	Format
GraphQL	`POST https://<api-host>/graphql`	`application/json` with `query` and `variables`
REST	`https://<api-host>/api/...`	Endpoint-specific (for example `multipart/form-data` for uploads)

<api-host> is the API host for your environment. Ask your Nucleus OS contact for the host and for API access for your workspace.

Your first request

Public operations work without authentication. This query lists open roles on the careers page:

curl -X POST https://<api-host>/graphql \
  -H 'Content-Type: application/json' \
  -d '{"query":"{ jobPostings { slug title department location } }"}'

A successful response looks like this:

{
  "data": {
    "jobPostings": [
      {
        "slug": "senior-product-designer",
        "title": "Senior Product Designer",
        "department": "Design",
        "location": "Vancouver, BC"
      }
    ]
  }
}

Concepts

Authentication

Send a Firebase ID token as a Bearer token for operations that need a signed-in user.

Errors

The error shape, status codes, and how to handle them.

Rate limits

Per-IP limits on public operations and how to handle 429 responses.

GraphQL reference

Every public query, mutation, and type, generated from the schema.

Conventions

One endpoint, POST only. Send every GraphQL operation as a POST to /graphql.
Ask for what you need. Select only the fields you use; responses are smaller and faster.
Use variables. Pass inputs in variables rather than interpolating them into the query string.
Dates are ISO 8601 strings in UTC (DateTime), for example 2026-01-15T09:00:00Z.
Introspection is disabled in production. Use the reference in these docs instead.

Supported surface

The GraphQL reference lists the operations that are part of the public, supported API. Other operations used internally by the web app may change without notice and should not be relied on.

API overview