The Vidmoat API

The engine behind the editor, as 27 REST endpoints. Create a project, apply edit commands, render it, read the result.

Base URL is https://api.vidmoat.com/v1. Everything is JSON except media upload (multipart) and the preview frame (an image). Authentication is a bearer token — an API key you mint in this console, or an OAuth access token once a user has granted your app access.

The one architectural fact worth knowing before you write any code: editing runs through the identical command reducer the editor uses. There is no second definition of what an edit means, so anything a person can do by hand is expressible as a command, and a command that works today keeps working.

End to end

export VIDMOAT_KEY=vmk_test_…

# create → edit → render → poll → download
ID=$(curl -s -X POST https://api.vidmoat.com/v1/projects \
  -H "Authorization: Bearer $VIDMOAT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"Hello, Vidmoat API"}' | jq -r .project.id)

curl -s -X POST https://api.vidmoat.com/v1/projects/$ID/commands \
  -H "Authorization: Bearer $VIDMOAT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"commands":[{"op":"addTextClip","text":"Hello","start":0,"duration":3}]}'

JOB=$(curl -s -X POST https://api.vidmoat.com/v1/renders \
  -H "Authorization: Bearer $VIDMOAT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"projectId":"'$ID'"}' | jq -r .render.id)

until curl -s https://api.vidmoat.com/v1/renders/$JOB \
  -H "Authorization: Bearer $VIDMOAT_KEY" | jq -e '.render.status=="COMPLETED"' >/dev/null
do sleep 5; done

Run it with a test key first: test keys never spend credits and never queue a real render, so the whole shape of the integration can be wired up before anything costs money. Swap in a live key when the plumbing is right.

Start here

Authentication

API keys for server-to-server work, and “Sign in with Vidmoat” when you act on somebody else’s account.

Scopes

What each permission grants, which ones can cost money, and why a scope is never sufficient on its own.

Endpoints

Every endpoint with a curl example, the scope it needs, and what it costs.

Video preview

Fetch a frame, or embed the live composition, without running a render.

Errors & limits

Stable machine codes, the rate-limit headers, and what to retry.

Get a key →

What is deliberately not in the API

Roughly 25 of Vidmoat’s 140-odd routes are public. The rest are internal and carry no versioning promise. These five are the ones people ask about:

Browser recorder

Holds a CPU core for about three minutes on the machine that serves the API. Per-app allowlist only.

Inpainting

One global CPU worker capped at 1/user — a single API caller would starve everyone else.

Flows

An orchestration product built on these primitives, not a primitive itself.

Vidmoat Social

Posting to a public feed as a third party is a moderation liability with no revenue. No scope grants it, and none will.

Channels, CDS, admin, billing

Internal surfaces with no versioning promise. They will be refactored without notice.

There is also an MCP server at https://api.vidmoat.com/api/mcp, which exposes the same capabilities as 33 agent tools over JSON-RPC. If you are wiring Vidmoat into Claude, ChatGPT or another MCP client, use that rather than the REST surface — it is the same engine, and the tool descriptions carry the design guidance the REST docs cannot.

Versioning. Additive changes ship into v1 — new fields, new endpoints, new enum values. Ignore unknown fields; a client that rejects them will break on a routine release. Breaking changes get a /v2, and v1 is supported for at least 12 months after one exists. Send Vidmoat-Version: 2026-08-01 to pin date-based behaviour within v1.