·
Last changedVersion:
This version passed the hardening gate. Hardening applied 1 targeted change and preserved all other text. Classified findings before hardening: 3. Classified findings closed: 0. Classified findings remaining: 3. Unclassified scanner findings remaining: 0. Review findings closed: 0. Review findings remaining: 11.
1
2
1
2
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
SKILL.md | Sensitive Data & Secret Exposure | Data exfiltration | Medium | Open | |
SKILL.md | Sensitive Data & Secret Exposure | Hardcoded secret | Low | Open | |
SKILL.md | Prompt Injection | Direct prompt injection | Low | Open |
3 findings
Base URL: https://api.dev.runwayml.com
All requests require these headers:
| Model | Endpoint | Input | Cost (credits/sec) |
|---|---|---|---|
|
| Text and/or Image | 12 |
|
| Image required | 5 |
|
| Video + Text/Image | 15 |
|
| Image/Video | 5 |
|
| Text/Image | 40 |
|
| Text/Image | 20-40 |
|
| Text/Image | 10-15 |
|
| Text, Image, and/or Video | 36 |
Video duration: 2-15 seconds (model-dependent). Aspect ratios are pixel-based: 1280:720, 720:1280, 1104:832, 960:960, 832:1104, 1584:672, etc.
Seedance 2 specifics:
1280:720, 720:1280, 960:960, 1112:834, 834:1112, 1470:630, 992:432, 864:496, 752:560, 640:640, 560:752, 496:864promptImage array with position) or image reference (references array)| Model | Endpoint | Cost (credits) |
|---|---|---|
|
| 5 (720p), 8 (1080p) |
|
| 2 |
|
| 5 |
| Model | Endpoint | Use Case | Cost |
|---|---|---|---|
|
| Text to speech | 1 credit/50 chars |
|
| Sound effects | 1-2 credits |
|
| Isolate voice from audio | 1 credit/6 sec |
|
| Dub audio to other languages | 1 credit/2 sec |
|
| Voice conversion | 1 credit/3 sec |
| Model | Description | Session Max Duration |
|---|---|---|
| Real-time conversational avatars powered by GWM-1 | 5 minutes |
Endpoints:
| Method | Endpoint | Description |
|---|---|---|
|
| Create a new Avatar |
|
| Retrieve an Avatar |
|
| Update an Avatar (name, voice, personality, documentIds) |
|
| Delete an Avatar |
|
| Create a new real-time session |
|
| Retrieve session status (poll until |
|
| Consume session credentials for WebRTC (one-time use) |
Avatar creation parameters:
| Parameter | Type | Description |
|---|---|---|
| string | Display name for the avatar |
| string | URL or |
| object |
|
| string | System prompt / personality instructions |
| string[] | Optional. IDs of knowledge base documents to attach |
Voice presets: clara (soft), victoria (firm), vincent (authoritative). Preview all at dev.runwayml.com.
Session statuses: NOT_READY → READY → RUNNING → COMPLETED (or FAILED / CANCELLED)
| Method | Endpoint | Description |
|---|---|---|
|
| Create a document (plain text or Markdown) |
|
| Retrieve a document |
|
| Delete a document |
Each Avatar supports up to 50,000 tokens of knowledge. Link documents to an Avatar via client.avatars.update(id, { documentIds: [...] }).
Use these when calling the API directly rather than via an SDK. Only required + common fields shown.
POST /v1/text_to_imagemodel: gen4_image | gen4_image_turbo | gemini_2.5_flash (required)promptText: string, up to ~1000 chars (required)ratio: one of 1920:1080, 1080:1920, 1024:1024, 1360:768, 1080:1080, 1168:880, 1440:1080, 1080:1440, 1808:768, 2112:912 (required; 720p or 1080p variants depending on model)referenceImages: optional [{ "uri": "https://...", "tag": "MyTag" }] — reference by @MyTag in promptTextseed: optional integer for reproducibilityPOST /v1/text_to_videomodel: gen4.5 | veo3 | veo3.1 | veo3.1_fast | seedance2 (required)duration: integer seconds, 2–10 (required; model-specific valid values — e.g. veo3 only accepts 8)ratio: e.g. 1280:720, 720:1280, 1104:832, 832:1104, 960:960 (required)POST /v1/image_to_videomodel: gen4.5 | gen4_turbo | veo3 | veo3.1 | veo3.1_fast | seedance2 (required)promptImage: HTTPS URL, data URI, or runway:// URI (required). Can also be [{ "uri": "...", "position": "first" | "last" }] for keyframes.promptText: optional for most models, required for gen4_turbo when no image motion is obviousPOST /v1/video_to_videoPOST /v1/text_to_speechvoice: { type: "runway-preset", presetId: "clara" | "victoria" | "vincent" | ... } or a provider-specific voice objectlanguageCode: optional ISO code (auto-detected by default)POST /v1/sound_effectPOST /v1/voice_isolationPOST /v1/voice_dubbingPOST /v1/speech_to_speechPOST /v1/avatarsPOST /v1/documentsPOST /v1/realtime_sessions| Method | Endpoint | Description |
|---|---|---|
|
| Get task status and output |
|
| Cancel/delete a task |
|
| Create ephemeral upload |
|
| Organization info & credit balance |
|
| Credit usage history (up to 90 days) |
All generation endpoints return a task object. The flow is:
POST /v1/<endpoint> → returns { "id": "task_xxx" }GET /v1/tasks/{id} → returns task with statusstatus === "SUCCEEDED", the output array contains signed URLs| Status | Meaning |
|---|---|
| Queued, waiting to start |
| Currently generating |
| Complete — output URLs available |
| Generation failed — check |
| Concurrency limit hit — auto-queued |
The SDKs provide a waitForTaskOutput() method that handles polling automatically:
output array with signed URLs to generated content| Type | Via URL | Via Data URI | Via Upload |
|---|---|---|---|
Image | 16 MB | 5 MB | 200 MB |
Video | 32 MB | 16 MB | 200 MB |
Audio | 32 MB | 16 MB | 200 MB |
If providing assets via URL:
Content-Type and Content-Length headers| Tier | Concurrency | Daily Gens | Monthly Cap | Unlock |
|---|---|---|---|---|
1 (default) | 1-2 | 50-200 | $100 | — |
2 | 3 | 500-1,000 | $500 | 1 day + $50 |
3 | 5 | 1,000-2,000 | $2,000 | 7 days + $100 |
4 | 10 | 5,000-10,000 | $20,000 | 14 days + $1,000 |
5 | 20 | 25,000-30,000 | $100,000 | 7 days + $5,000 |
THROTTLED status (auto-queued, not rejected)429 Too Many Requests| Code | Meaning | Action |
|---|---|---|
400 | Input validation failure | Fix input, do not retry |
401 | Invalid API key | Check key, do not retry |
429 | Rate limited | Retry with exponential backoff + jitter |
502/503/504 | Server overload | Retry with exponential backoff + jitter |
| Code | Meaning | Retry? |
|---|---|---|
| Input content moderation | No — not refundable |
| Output content moderation | Yes — try different prompt |
| Quality issue | Yes |
| Bad input format | Fix input |
| Server error | Yes |
The SDKs handle retries for transient errors automatically.
Base64-encoded images can be passed instead of URLs:
Useful for small images or when you don't want to host the file. Subject to the data URI size limits above.
Get started with chainctlchainctl skill install public/runwayml/rw-api-reference:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/runwayml/skills/rw-api-reference:latest
MIT
HARDENING.md
LICENSE
SKILL.md