Which Sume API routes work without a key? Six public routes

Six routes on the Sume API need no key: GET /v1/health, GET /v1/catalog, GET /v1/openapi.json, GET /v1/bgm/catalog, GET /v1/bgm/categories, and POST /v1/bgm/pick. Every other /v1 route needs a key. That makes the catalog usable from a CI job, a pricing check, or a status page that does not hold a secret.

The list is from the API reference page, read 2026-10-09. The catalog returns capabilities, endpoints, runtime readiness, models, and pricing metadata, so it is the right preflight before you hard-code a model id.

The public routes

The notes column paraphrases the API reference.

How they are limited

Unauthenticated requests are limited per client IP at the Free rate. The Free plan allows 120 writes a minute, and an anonymous read bucket is four times the write rate, which is 480 reads a minute, not the forty times that a key owner gets. A shared CI runner IP shares that bucket with everything else that runs behind it, so cache the catalog and do not fetch it on every build step.

Sume's own live schema is at https://api.sume.com/reference/json, and the reference page says exact request and response shapes should come from it, not from the Markdown tables. Use the public routes to read, and a key for everything that creates a job.

Why a preflight helps

Model lists and prices change, and the catalog is where Sume publishes them. A build that reads the catalog before it submits a paid request can fail early if a model id is missing, instead of failing with 404 model_not_found in production. Prices in the catalog are the public Sume amounts, and the rate card at https://www.sume.com/pricing/api is named in the Developer API overview as the source of truth for prices.

The catalog is also a way to see whether a model you read about this week is listed at all. If an id is not in the response, Sume does not offer it, and you should not guess an id.

A CI preflight

The script checks health, fetches the catalog, and prints the status and remaining budget. It makes no assumption about the JSON shape of the catalog beyond it being a valid response.

import asyncio

import httpx


async def main():
    async with httpx.AsyncClient(base_url="https://api.sume.com", timeout=15) as client:
        for path in ("/v1/health", "/v1/catalog"):
            r = await client.get(path)
            print(path, r.status_code, "remaining:", r.headers.get("ratelimit-remaining"))
            r.raise_for_status()


asyncio.run(main())

When a key is needed

GET /v1/me verifies a key, GET /v1/balance shows the USD balance, and every generation endpoint needs a key, plus an Idempotency-Key on a paid submit if you plan to retry. Keep the key on a server, as the Authentication page says, and send exactly one of Authorization: Bearer or x-api-key. Sending both is a 401.