Skip to main content
You don’t need this page to use Copilot. Your agent makes these calls for you. This page is for developers who want to call the API directly.

Base URL and sign-in

All endpoints are under https://copilot.colosseum.com/api/v2. Paths on this page are relative to it. Every request needs a token from Colosseum’s sign-in tool. Sign in once:
Then pipe a token from the tool straight into each request, so it never shows up in your terminal, logs or shell history:
A project search looks like this:
The token command renews your sign-in when it needs to. Don’t print its output or pass the token as a command-line argument. Send JSON bodies with Content-Type: application/json, up to 1 MB. Send your installed skill version in the X-Copilot-Skill-Version request header on every Copilot API request; these examples use 2.0.3. Every response includes an X-Copilot-Skill-Version header with the current skill version. Old access tokens work only on /api/v1, which covers four hackathons and not Frontier. They stop working at 00:00 UTC on October 28, 2026. An old token sent to /api/v2 gets 401 V2_SIGN_IN_REQUIRED.

Endpoints

Request and response fields are in the field reference.

Your own data

GET /me returns your own Arena profile, current-hackathon registration and projects where you are an owner or member. Projects include drafts, private submission fields, teammates, update history, a public accelerator cohort and prizes after results are published. Teammates contribute only their names, usernames and Arena-visible profile fields, never email addresses. The response includes up to 200 projects and 2,000 updates across them; truncated.projects and truncated.updates show when either cap was reached. It is returned with Cache-Control: private, no-store. Call this endpoint only when the person’s own work or history matters. It needs self-data:read (or its older alias copilot:self-data). An old token gets 401 V2_SIGN_IN_REQUIRED; a token missing the scope gets 403 INSUFFICIENT_SCOPE. Profile data that is temporarily unavailable returns 503 SERVICE_UNAVAILABLE.

Projects

  • Search. POST /search/projects ranks projects by similarity to your query. Results favor the closest matches; set diversify: true for more variety across hackathons and tracks. An empty query lists every project that matches your filters, newest first.
  • Counting. With an empty query, totalFound is the exact number of matching projects. With a text query, totalFound only supports paging, so don’t treat it as a count. Check filtersApplied to see the filters that were used.
  • Facets. Set includeFacets: true and list the facets you want in facets. The default list leaves out categories. Facets count everything that matches your filters and ignore the text query.
  • Details. Search results leave out the summaries of each team’s code, pitch and demo. Fetch GET /projects/by-slug/:slug for those.
  • Valid values. GET /filters lists hackathon slugs and start dates, prize track keys, submission label keys, accelerator batches, prize types, tags and research library sources.
  • Prizes. award is winner, honorable_mention or null. filters.winnersOnly, isWinner, winnerCount and the winners totals exclude honorable mentions. Use filters.prizeTypes: ["HONORABLE_MENTION"] to find mentions separately; they carry prize.type: "HONORABLE_MENTION" with no amount, and they’re recognitions, not wins. Frontier had no tracks: its 25 TRACK_PRIZE awards named Winner are its top-25 awards, not track prizes.
  • Tracks and labels. tracks lists the prize tracks a project entered, not the one it won. The track a project won is prize.trackName; to list a track’s winners, filter winnersOnly results by prize.trackName. Events without track prizes, including Frontier, return submission choices in labels. trackClassification is prize_tracks, submission_labels or ambiguous; ambiguous projects expose neither. Search with labelKeys from /filters.labels or the labels facet. Do not combine labelKeys and trackKeys; a trackKeys filter for an event without track prizes is rejected.
  • Scores. With includeDiagnostics: true, the response shows how results were ranked. Compare scores only between results ranked the same way.

Categories

Every project has one main category (primaryKey), sometimes a related second one (secondaryKey), and a confidence of high, medium or low for the main one. Confidence says how clearly the project fits, not how good it is. A new project can have categories: null until it’s been categorized. GET /categories returns the current map: its version, six areas, and 41 categories with keys, labels and definitions, plus other-emerging (no category fits) and insufficient-information (the public material doesn’t say enough).
  • filters.categoryKeys takes one to ten category keys and matches any of them. To cover an area, list its category keys.
  • Filters, facets and POST /analyze count main categories only by default. Set includeSecondaryCategories: true to include second categories. Those counts can overlap, and the response then sets categoryCountsOverlap: true.
  • For every category count in one request, call POST /analyze with dimensions: ["categories"] and topK: 43. Category facets also accept facetTopK: 43. Other dimensions and facets return at most 20 buckets.
  • POST /compare doesn’t accept categories.

Technologies

Four routes count the tools recorded in teams’ public code: POST /technologies/counts, /co-usage, /trends and /top. A technology is written as { "category": "frameworks", "name": "Anchor" }. The seven categories are languages, frameworks, chains, protocols, services, tooling and standards. Names match without regard to case, with no aliases or partial matches. Look up recorded names in project details. Each route accepts an optional cohort. Leave it out to include every project.
hackathonSlugs takes one to 20 slugs and categoryKeys one to ten keys. With winnersOnly: true, honorable mentions are left out unless includeHonorableMentions is also true. includeHonorableMentions needs winnersOnly: true. Unknown fields are rejected. Unknown technologies or hackathons return zero results.
  • Counts: { "technology": {...}, "cohort": {...} } returns how many projects are tagged with it, overall and per hackathon.
  • Used together: same body plus optional topK (1 to 50, default 10). Returns the technologies most often used alongside it.
  • Trends: same body as counts. Returns usage per hackathon, in date order.
  • Top: optional cohort, technologyCategory and topK. Returns the most-used technologies. Leave out technologyCategory to rank across all seven.
Shares use the whole cohort as the denominator, including projects with no recorded tools. Compare projectsWithRepositoryTags across cohorts before reading a change in share as a change in adoption. A missing tag doesn’t prove a project didn’t use something.

Research library

  • Search. POST /search/archives returns snippets of up to 240 characters and pages up to offset 50. totalFound supports paging and isn’t an exact count. totalMatched counts text matches only. searchTier shows which search method found the results. maxDocsPerSource: 0 removes the per-source cap.
  • Reading. GET /archives/:documentId returns a document a page at a time. maxChars defaults to 8,000 and can be 200 to 20,000.
  • Excerpts. Some licensed sources are available only as excerpts. Their responses have isExcerpt: true (and restricted: true), at most 1,000 characters in total, an excerptNote, and a url to the full piece on the publisher’s site.
  • Withdrawn documents return 404 NOT_FOUND.

Builder tools

GET /resources returns sponsors, resource topics and RPC providers from Colosseum’s hackathon resources hub. topic filters topics only, not sponsors or RPC providers. Arrays excluded by kind come back empty. Unknown tracks return 404, and an ambiguous topic returns 400. The V2 response includes eventDates for the requested hackathon: hackathonSlug, startDate, submissionDeadline and winnerAnnouncementDate, which is null until Colosseum records it. Hackathons without a resources page return 404. Confirm consequential dates on the event page. Data is cached for 10 minutes. After that, the cached copy is returned with source.stale: true while it refreshes. Copies older than 24 hours are never returned. When pointing people to the tools, link Colosseum’s resources hub rather than source.url. Errors: 404 NOT_FOUND for an unknown hackathon, 400 INVALID_QUERY for a bad parameter, and 503 resources_unavailable if the hub can’t be reached and there’s no cached copy.

Program FAQs

GET /faqs?program=accelerator&q=funding lists or searches Colosseum’s official FAQs.
  • program is optional: hackathon, eternal, accelerator or stamp.
  • q is optional, 2 to 200 characters. It’s a keyword search that ranks matches in the question above matches in the answer. No matches returns an empty faqs list.
  • GET /faqs/:program/:id returns one FAQ. Unknown IDs return 404.
V2 FAQ lists and details include eventDates for the most recently started hackathon, or null when the response has no hackathon FAQ (for example program=accelerator). Each FAQ includes sourceUrl, the live program page it comes from. contentRevision identifies the text, not when it was published. For deadlines and eligibility, the live page is the final word.

Sharing questions and answers

POST /session-shares saves a conversation when the user opted in to sharing for this sign-in. The sign-in tool’s share command calls it for you and removes likely secrets first.
  • Requirements: a sign-in with sharing turned on and the telemetry:write scope. Without both, the request gets 403 INSUFFICIENT_SCOPE. GET /status shows sessionSharingEnabled.
  • Body: sessionId (a UUID) and messages: 2 to 100 objects with role (user or assistant) and content (1 to 20,000 characters), with at least one of each role. The messages array can be up to 100,000 characters in total.
  • New conversation: 201 with { saved: true, expiresAt }. Conversations are kept for 12 months.
  • Same sessionId again: 200. Adding messages to the end returns saved: true. Otherwise it returns saved: false with a reason: unchanged, not_newer (the upload is shorter than the saved copy, or its earlier messages differ) or expired. Updates don’t change the expiry date.
Text that looks like a credential is removed before saving. See Privacy and your data for how shared conversations are used.

Feedback and source suggestions

POST /feedback sends a note to the Colosseum team. context can be up to 10,000 characters once serialized. POST /source-suggestions suggests a source for the research library; the URL must be public HTTP or HTTPS with no embedded credentials.

Scopes

The sign-in tool requests evidence:read, self-data:read and telemetry:write. telemetry:write shares nothing unless the user also opts in when approving. GET /status returns granted scopes as a space-separated string. copilot:retrieval, copilot:telemetry and copilot:self-data are older names for the same three scopes. profile:read can be requested but isn’t included by default. projects:updates:write and submissions:write are reserved; no endpoint writes to your project.

Limits

Limits apply per account, across all of its tokens. Over a limit, you get 429 with a Retry-After header in seconds. Going over the two-at-once limit returns Retry-After: 1. If Retry-After is longer than 60 seconds, do not wait or retry; tell the user the limit is reached for now and continue with search and filters.

Errors

Error responses have error (a message), code and retryable. Server errors can also include requestId; send it with any support request, but never a token. Other codes can appear; follow the status and retryable flag. A search with no results is a successful response, not an error.