> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usehasp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Search the knowledge base and return matched chunks with scores and citations

> HASP-513, ADR-FV2X8A. Runs the caller's query through the same
RagRetrievalOrchestrator chokepoint every knowledge.search caller
(Assistant, Public API messages, Agent SDK) uses. That single call
enforces RagV1 + OrgRagSetting.enabled, scans the query for PHI
before it leaves Hasp, bills the query-embedding tokens to AI
credits (HASP-516), records a RagRetrieval + RagCitation trail, and
emits the rag.retrieval_completed audit event — none of that is
reimplemented here.



## OpenAPI

````yaml /openapi/v1.json post /knowledge/search
openapi: 3.1.0
info:
  title: HASP AI API
  version: '2026-07-12'
  description: >-
    The HASP Public AI API is the regulated-AI substrate for healthcare and
    other

    regulated industries — identity, policy, audit, compliance, and PHI handling

    for AI inference, exposed via two surfaces:


    - **Native (`/v1/ai/*`)**: HASP-native chat with full event taxonomy, run
    lifecycle,
      and PHI metadata.
    - **Anthropic-compat (`/v1/messages`)**: Drop-in replacement for
    `@anthropic-ai/sdk` —
      change only `baseURL`. All Gateway compliance checks (BAA, credits, PHI policy) apply.

    All requests require an API key (`Authorization: Bearer
    hasp_api_live_<key>`). See

    [Authentication](https://docs.usehasp.com/ai-api/authentication) for key
    management.
servers:
  - url: https://api.usehasp.com/v1
    description: Production
security:
  - http: []
paths:
  /knowledge/search:
    post:
      tags:
        - KnowledgeDocument
      summary: >-
        Search the knowledge base and return matched chunks with scores and
        citations
      description: |-
        HASP-513, ADR-FV2X8A. Runs the caller's query through the same
        RagRetrievalOrchestrator chokepoint every knowledge.search caller
        (Assistant, Public API messages, Agent SDK) uses. That single call
        enforces RagV1 + OrgRagSetting.enabled, scans the query for PHI
        before it leaves Hasp, bills the query-embedding tokens to AI
        credits (HASP-516), records a RagRetrieval + RagCitation trail, and
        emits the rag.retrieval_completed audit event — none of that is
        reimplemented here.
      operationId: v1.knowledge.search
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SearchKnowledgeRequest'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                anyOf:
                  - type: object
                    properties:
                      data:
                        type: array
                        items:
                          type: array
                          items: {}
                      meta:
                        type: object
                        properties:
                          retrieval_id:
                            type: string
                          result_count:
                            type: integer
                        required:
                          - retrieval_id
                          - result_count
                    required:
                      - data
                      - meta
                  - type: string
        '401':
          description: Bearer token is missing, malformed, or revoked.
          content:
            application/json:
              schema:
                type: object
                example:
                  success: false
                  error:
                    type: authentication
                    code: INVALID_API_KEY
                    message: Bearer token is missing, malformed, or revoked.
                    param: null
                    details: null
                    retryable: false
                    request_id: 01JQREQ7XZQK5N6PZ1VVXHYB8T
                  meta:
                    request_id: 01JQREQ7XZQK5N6PZ1VVXHYB8T
        '403':
          description: >-
            The caller is authenticated but lacks the scope or capability this
            route requires.
          content:
            application/json:
              schema:
                type: object
                example:
                  success: false
                  error:
                    type: permission
                    code: MISSING_SCOPE
                    message: >-
                      The caller is authenticated but lacks the scope or
                      capability this route requires.
                    param: null
                    details: null
                    retryable: false
                    request_id: 01JQREQ7XZQK5N6PZ1VVXHYB8T
                  meta:
                    request_id: 01JQREQ7XZQK5N6PZ1VVXHYB8T
        '422':
          $ref: '#/components/responses/ValidationException'
        '429':
          description: >-
            Rate limit exceeded. Retry after the window indicated by
            `Retry-After`.
          content:
            application/json:
              schema:
                type: object
                example:
                  success: false
                  error:
                    type: rate_limited
                    code: RATE_LIMITED
                    message: >-
                      Rate limit exceeded (per-key, per-org, or daily cap,
                      depending on which limiter tripped).
                    param: null
                    details: null
                    retryable: true
                    request_id: 01JQREQ7XZQK5N6PZ1VVXHYB8T
                  meta:
                    request_id: 01JQREQ7XZQK5N6PZ1VVXHYB8T
          headers:
            Retry-After:
              description: Seconds until the rate-limit window resets.
              schema:
                type: integer
            X-RateLimit-Limit:
              description: The request cap for the current window.
              schema:
                type: integer
            X-RateLimit-Remaining:
              description: Requests remaining in the current window (0 on a 429).
              schema:
                type: integer
            X-RateLimit-Reset:
              description: Unix timestamp when the window resets.
              schema:
                type: integer
components:
  schemas:
    SearchKnowledgeRequest:
      type: object
      description: >-
        Validates POST /v1/knowledge/search (HASP-513, ADR-FV2X8A).


        `max_chunks`/`similarity_threshold` mirror the bounds

        UpdateRagSettingsRequest enforces on the org-level defaults these
        override

        per-call.
      properties:
        query:
          type: string
          maxLength: 8000
        max_chunks:
          type:
            - integer
            - 'null'
          minimum: 1
          maximum: 20
        similarity_threshold:
          type:
            - number
            - 'null'
          minimum: 0
          maximum: 1
      required:
        - query
      title: SearchKnowledgeRequest
  responses:
    ValidationException:
      description: Validation error
      content:
        application/json:
          schema:
            type: object
            properties:
              message:
                type: string
                description: Errors overview.
              errors:
                type: object
                description: A detailed description of each field that failed validation.
                additionalProperties:
                  type: array
                  items:
                    type: string
            required:
              - message
              - errors
  securitySchemes:
    http:
      type: http
      scheme: bearer

````