Platform · Enterprise Knowledge API
Your organisation’s knowledge, answerable from every application.
Your policies, manuals, circulars, contracts and price lists already live in ZenithAI workspaces, where people ask about them in chat. The Enterprise Knowledge API brings the same answers into the software your organisation runs: the intranet, the help desk, a branch app, a team chat bot, a nightly check. One call sends a question and gets back an answer from your own documents, the documents it came from, and a plain found: false when the documents don’t say. It runs on your servers, it sees only what the asker is allowed to see, and it keeps nothing.
Released 15-10-2026 as /workspace. It isn’t in the 4.6.0 installer: it ships with the next installer, and a server gets it when it’s updated.
Why this matters now
The knowledge exists. The answer still takes a phone call.
Every organisation writes down how it works. Then the answers get stuck in the documents, and the documents get stuck in folders, portals and inboxes that only a few people know how to search. Generative AI was supposed to fix that. In most organisations it raised a second problem: where the documents go when someone asks.
- 47%of digital workers struggle to find the information or data they need to do their jobs well.Gartner Digital Worker Survey, 4,861 employees across countries including India; press release, May 2023
- 48%of employees admit using AI in ways that break company policy, including uploading sensitive company information into free public AI tools.KPMG and the University of Melbourne, Trust, attitudes and use of artificial intelligence: A global study 2025, 48,000+ people in 47 countries; study release
- 77%of organisations factor an AI solution’s country of origin into vendor selection, and 83% call data residency and in-country compute at least moderately important.Deloitte, State of AI in the Enterprise, January 2026, 3,235 leaders in 24 countries; report (PDF)
Read together: people can’t find what their own organisation knows, they reach for public tools to fill the gap, and leadership increasingly wants the answer engine to sit inside its own boundary. An answer API on your own servers addresses all three at once.
What one call does
A question in. An answer you can check, out.
Retrieval-augmented generation (RAG) usually means a project: a vector database, a chunking pipeline, embeddings, a permission layer, prompt engineering and an evaluation harness. With ZenithAI that work is already done inside the platform, on your hardware. Your developers send a question and a workspace id. ZenithAI finds the relevant passages, reads the documents, calculates when the question is about numbers in a spreadsheet, and writes the answer.
- Answers only from your documents. The API never searches the web, even when the question asks it to.
- Says when it doesn’t know. If the documents don’t cover the question,
foundisfalseand the answer says so, naming the documents it checked. No confident guess. - Shows its sources. Every answer lists the documents behind it. Ask one document and the source is exact.
- Sees what the asker sees. A key answers as the person who created it, with exactly the workspaces they can open in ZenithAI. Remove their access and the key loses it at once.
- Keeps nothing. No chat is saved, and the question and answer aren’t kept on the server. Logs record ids, counts and timings, never the question, the answer or a document name.
- Calculates, doesn’t guess. Ask for a total or an average over a CSV or Excel file and the figure is computed, not read off text.
How it looks to a developer
Three steps. No retrieval code.
Put the documents in a workspace. Create an API key. Call POST /workspace. The full field list, streaming events and error codes are in the API reference.
curl https://your-server/workspace \
-H "Authorization: Bearer $API_KEY" \
-H "Content-Type: application/json" \
-d '{
"workspace_id": "9f2c41d0...",
"question": "How many days of annual
leave do permanent
employees get?"
}'
{
"status": "completed",
"found": true,
"answer": "Permanent employees get
24 days of annual leave per
calendar year (Leave Policy.pdf).",
"sources": [
{"name": "Leave Policy.pdf", ...},
{"name": "Monthly sales.csv", ...}
],
"coverage": {"mode": "whole",
"documents_checked": 2}
}
foundThe honesty switch.falsewhen the documents don’t hold the answer. Your application decides what happens next: show a polite message, hand over to a person, or log the gap so someone adds the missing document.sourcesWhat the answer stands on. The documents behind the answer, so a reader can open the policy and check. Asking a single document marks its source as definitely used.coverageHow the answer was made. Whether the whole workspace was read, the most relevant parts were searched, or the figure was computed from a spreadsheet, and how many documents were checked.historyFollow-ups without storage. Your application keeps the conversation and sends earlier turns back, so “and for managers?” works while the server stays stateless.streamLong answers, live. Summaries across many documents arrive piece by piece, with progress stages, instead of making the user wait.
New on 17-10-2026
Your software can fill the workspace as well as ask it.
A document system, an HR portal or a nightly job can add a new circular, policy or contract the moment it is approved, so the next question already finds it. POST /workspace/documents adds one file; a status call follows it until it is ready to be asked.
Not in installer 4.6.0: it ships with the next installer. See the whole journey of a workspace on Workspaces.
- Allowed per key. An administrator ticks Can add documents for each key that may add files. Every other key stays read-only.
- Only your own workspaces. A key adds to its owner’s personal workspaces, never to shared or organisation ones.
- Five file types. TXT, PDF, DOCX, XLSX and CSV, up to the server’s file limit (currently 3 MB). Scanned PDFs are read with OCR on your server.
- Safe to retry. Your program names each upload with its own 12-character id first. After a time-out it asks for the status with that id instead of sending again, and the same file is never stored twice.
- Limits it can read. Every answer carries the live limits and the day’s use, so a program never has to remember numbers.
Every field, status and error code: API reference: Add a document.
Where teams put it
Knowledge where the work already happens.
People shouldn’t have to leave the system they’re working in to find out what the organisation has already decided. These are illustrative patterns, each built on the same call.
| Where the question comes from | A typical question | Workspace behind it |
|---|---|---|
| Intranet search box | “What is the hotel limit for a manager in a metro city?” | HR and travel policies |
| Bank branch staff app | “Which documents are needed to open a current account for a partnership firm?” | Circulars and process notes supplied by the bank |
| Help desk, before the agent replies | “What is the warranty on the 1.5 tonne model?” | Product manuals and warranty terms |
| University student portal | “What is the minimum attendance to sit the semester exam?” | Academic regulations and notices |
| Government department’s internal system | “Who can sanction a purchase above this limit?” | Delegation of financial powers and office orders |
| A nightly contract check | “Does this agreement allow termination without notice?” | One contract, asked as a single document |
| Team chat bot | Anything, answered as plain text | An organisation-wide workspace |
Each answer depends on the documents your organisation supplies and keeps current. Staff remain responsible for decisions; the API tells them what the documents say and where it says it. For integrations across compliance, onboarding and email, see API integration use cases.
The hard part of enterprise RAG
Permissions, privacy, and the courage to say “not found”.
Most enterprise knowledge projects don’t fail on the model. They fail on three questions the security team asks first. Who can see what? Where do the documents go? What happens when the answer isn’t there?
The OWASP Top 10 for LLM Applications (2025) lists sensitive information disclosure and weaknesses in retrieval stores among the main risks, and recommends permission-aware retrieval. Researchers at Stanford tested commercial legal research tools built on retrieval and found they still made things up more than 17% of the time (Stanford RegLab and HAI, 2024). Retrieval reduces wrong answers; it doesn’t remove them. That’s why the API is built around checks your software can read.
- 01Access follows the person · the same workspace isolation as the app: a workspace the key’s owner can’t open simply doesn’t exist for the key. Organisation workspaces follow the membership set by their managers.
- 02Documents stay on your servers · retrieval, reading and answer writing happen on your ZenithAI deployment, with no external model API in the path. The endpoint never reaches the web.
- 03Nothing to leak later · questions and answers aren’t stored, and the logs hold no content. Metadata you attach comes back to you and is never logged.
- 04“Not found” is a first-class answer · a machine-readable
foundflag means your application never has to guess whether the model guessed. - 05Usage you can see · answers count as API use in the administrator’s usage view, and administrators can switch the endpoint off or tighten its limits.
For Indian organisations
Accountability doesn’t move when the documents do.
Under India’s Digital Personal Data Protection Act, 2023, the organisation stays responsible for reasonable security safeguards over personal data, including when a processor handles it. The DPDP Rules were notified on 13-11-2025, and most obligations apply from 13-05-2027. Every document sent to an outside AI service adds a processor to that chain.
Keeping the knowledge engine on infrastructure you control keeps that chain short. ZenithAI’s architecture supports data-residency and data-minimisation objectives, including obligations under the DPDP Act; it isn’t a certification, and your own controls and contracts still matter. For banks and NBFCs, the RBI’s August 2025 FREE-AI committee report put AI inventories, audit and vendor oversight on the agenda, and an answer that names its sources and runs inside the institution is easier to account for.
Related: DPDP AI readiness checklist · RBI AI readiness checklist · Security and governance
Before you switch it on
What to set up, and what it won’t do.
- Check who can see what. The API honours your existing workspace sharing, including any mistakes in it. Review organisation workspace membership before you connect an application.
- Give each integration its own account. Create its key from an account that can open only the workspaces it needs. Anyone holding a key can read what its owner can.
- Retire old versions. Answers come from what’s in the workspace, so a superseded circular left next to the new one can still be quoted.
- Plan for “not found”. Decide what your application shows when
foundisfalse, and treat those questions as the list of documents to add next.
| Scope | The whole workspace, or exactly one document. Choosing several documents or website imports in one call is planned for a later release. |
|---|---|
| Web | Never. For answers that need the internet, use ZenithAI chat with web search switched on. |
| Files | No attachments in the call and no Word, Excel or PowerPoint output. The documents come from the workspace. |
| Accuracy | Wrong answers are reduced, not ruled out. Show the sources and let people check anything that matters. |
| Adding files | Only keys an administrator allows, only to the key owner’s own personal workspaces. There is no delete in the API: remove documents in the web app. |
| Availability | Asking released 15-10-2026, adding documents 17-10-2026; neither is in installer 4.6.0. They ship with the next installer. |
When a hosted AI service is still the right call: if your documents are already public, or the questions don’t touch internal material, a cloud service may be quicker to start. The case for an on-premises answer API is strongest when the documents are confidential, regulated, or the reason your organisation is trusted.
Questions
The Enterprise Knowledge API, answered.
What is the ZenithAI Enterprise Knowledge API?
/workspace endpoint. Your software sends a question and a workspace id, and ZenithAI answers from that workspace’s documents on your own servers. The reply holds the answer, the source documents, a found flag and how the answer was made. It is the same answer the ZenithAI app gives in that workspace.Is it a RAG API?
What happens when the answer is not in our documents?
found as false. The answer says the documents don’t cover the question and names the documents it checked, and no sources are listed. It doesn’t fill the gap from the model’s general knowledge or from the web, so your application can show its own message or hand the question to a person.Does the API respect who is allowed to see which documents?
Are our questions and answers stored?
Can it answer questions about numbers in our spreadsheets?
Does it help with DPDP Act obligations?
Which ZenithAI servers have it?
/workspace. It is not in the 4.6.0 installer; it ships with the next installer, and a server gets it when it is updated. Administrators can switch it off or change its limits in the server’s API settings. The developer guide and the full reference are on docs.zenithai.si.The thinking behind it: Enterprise knowledge management with generative AI: what the research says, and what to build. For people asking in chat rather than through software, see a private internal knowledge base.
Bring your own documents
Ask the questions your staff ask. See what comes back.
In a demonstration, load a few of your real policies or manuals into a workspace and ask them through the API, including a question the documents can’t answer.