Reference
Authentication
Per-route authentication modes and required scopes.
How each /api/v1/** route authenticates. session = better-auth cookie, pat = Bearer pat_…, both = either, public = none.
| Path | Method | Auth | Scope | Summary |
|---|---|---|---|---|
/api/v1/integrations | GET | both | integrations:read | List project integrations |
/api/v1/integrations | POST | both | integrations:write | Connect a provider credential |
/api/v1/openapi | GET | public | — | OpenAPI document compiled from product operations |
/api/v1/devices/counts | GET | session | data | How many devices a project holds, optionally grouped by a declared filter. |
/api/v1/devices/schema | GET | public | — | The published spec for the devices resource. |
/api/v1/devices/provision | POST | both | — | Provision a device and return its credential once |
/api/v1/[resource]/[...path] | GET | both | — | Read a declared product operation |
/api/v1/[resource]/[...path] | POST | both | — | Execute a declared product operation |
/api/v1/[resource]/[...path] | PATCH | both | — | Update a declared product resource |
/api/v1/[resource]/[...path] | DELETE | both | — | Delete a declared product resource |
/api/v1/operations | GET | public | — | Discover the product operation catalog and schemas |
/api/v1/projects/[id]/setup | GET | both | — | Read setup status |
/api/v1/projects/[id]/setup | POST | both | — | Start explicit AI setup |
/api/v1/tasks/[id]/cancel | POST | both | — | Cancel a task's active run (declared tasks.cancel) |
/api/v1/github/app/install | GET | session | — | Redirect to the GitHub App install page with a session-bound state. |
/api/v1/github/app/install | POST | session | — | Start a workspace GitHub installation. |
/api/v1/github/connection | GET | session | — | Read a workspace's GitHub installations and connection outcome. |
/api/v1/github/connection | POST | session | — | Check GitHub administrator approval for the requested account. |
/api/v1/client-events | POST | public | — | Forward one browser error/telemetry event to Sentry server-side; returns the real ingest outcome. |
/api/v1/scorecards/scan-attempts | GET | session | — | Newest scorecard scan attempt per scorecard for a project (task-level evidence a scan was tried, even when the run wrote nothing). |
/api/v1/integrations/[id]/links | GET | session | — | Workspace projects with a linked flag for one credential (feeds the multi-project attach dropdown). |
/api/v1/integrations/[id]/teams | GET | session | — | Teams a team-time connection's credential can read, each flagged selected (feeds the report team picker). |
/api/v1/pull-requests/review-latency | GET | session | — | p50/p75 review duration for similar-sized PRs in this workspace over the last 24h (planner-degraded runs excluded and counted). |
/api/v1/views/[viewId]/hover-actions/[actionId]/suggest | POST | both | — | AI menu suggestions for a declared hover action group (server re-reads the declaration; named suggest_timeout/suggest_error failures, no fallback content). |
/api/v1/public/review-stats | GET | public | — | Aggregate review precision (1 − false-positive rate over human-dispositioned findings, trailing 30 days) across all IonWarp projects, per reviewer lens; unpublished below a minimum-sample floor. |
/api/v1/ionwarp/findings/precision | GET | session | project | False-positive / precision cuts for the project's workspace and the fleet (trailing 30 days), optionally for one reviewer lens. |
/api/v1/ionwarp/reviewer-examples | GET | session | — | List a reviewer's examples for a project (platform + workspace rows) with per-project enabled state, enabled-first, FTS5 search via q. |
/api/v1/ionwarp/projects/[id]/knowledge | GET | session | — | Read a project's ionwarp.json — the planner-distilled repository facts, the custom context, and the rendered block every reviewer reads. |
/api/v1/ionwarp/projects/[id]/knowledge/refresh | POST | session | — | Start a refresh-only run that re-derives the project's ionwarp.json; 409 knowledge_refresh_in_flight while one is running. |
/api/v1/ionwarp/reviewer-examples/toggle | POST | session | — | Switch one reviewer example on or off for this project (writes ionwarp.review.examples.disabled). |
/api/v1/moab/agent-view | GET | both | project | The ONE derived agent read model (readAgentView) for a project — fleet header, every agent row, and today's plan + ledger — behind the Agents table, Home, the day page and the agent header. |
/api/v1/moab/channels/webhook/resend | POST | public | — | Resend delivery webhook (svix-signed): email.sent/delivered/bounced/complained → the outbox ladder. |
/api/v1/moab/links/domains | GET | both | — | Tracking-domain registry rows + derived default (probes pending domains). |
/api/v1/moab/links/domains | POST | both | — | Add, verify, or retire a tracking domain (append-only lifecycle). |
/api/v1/billing/publishable-key | GET | public | — | This Worker's Stripe publishable key (runtime binding; test on staging, live on production). |
/api/v1/billing/reconcile | POST | session | — | Project the current Stripe subscription state into workspace_billing (webhook-independent activation). |
/api/v1/billing/add-seats | POST | session | — | Purchase additional seats (quantity; prorated on the Stripe subscription). |
/api/v1/tasks | GET | session | — | List tasks for a project (project_id query param). |
/api/v1/tasks | POST | both | project | Create a task (optionally scheduled). |
/api/v1/programs/[page_slug]/apply | POST | public | — | Apply to a declared discount program (delivers to its declared address). |
/api/v1/projects | GET | session | — | List the authenticated user's projects. |
/api/v1/projects | POST | session | — | Create a project. |
/api/v1/projects/[id]/moab/plan-execute | POST | both | project | Execute a Moab plan now, with no model turn — the same server step the planner run's plan_execute tool calls: sends tagged agents' drafts inside the cap, judges experiments, archives, launches, spawns prospectors and writes the day's runs[] entry. |
/api/v1/projects/[id]/checklists/[definitionId]/run | POST | both | project | Evaluate a daily (Beast Mode) checklist now — starts one beast-mode-checklist run; the result still derives from its published day record. |
/api/v1/projects/[id]/performance | GET | both | project | Read one metric as a day-by-day series (metric, by, from, to, top, mode, f.*) for the Performance chart — count metrics via the DataStore, cost/credits/tokens via the usage ledger. |
/api/v1/projects/[id]/agents-md | GET | both | project | Read the Agents.md hand-off for a project: the IonWarp section, a patch per existing AGENTS.md/CLAUDE.md, whether the marker is present, and the coding-agent instruction. |
/api/v1/projects/[id]/metrics | GET | both | project | Resolve the agent's metric registry for one owner (project or object) and window — the ONE read every metric tile and hover renders. |
/api/v1/projects/[id]/pages/[pageId]/preview | GET | session | project | Render one Moab page (sandbox included) as HTML for the dashboard preview iframe — the same renderer the pages host serves. |
/api/v1/projects/[id]/pages/[pageId]/preview-url | POST | both | project | Mint a short-lived signed preview URL for one page row — the browser-loadable reload target of the page-lab build loop (sandbox run tokens accepted, same door as the data API). |
/api/v1/projects/[id]/share-image | POST | session | — | Publish a project artifact as the public share-card background. |
/api/v1/projects/[id]/share-image | DELETE | session | — | Unpublish a project share-card background. |
/api/v1/data | GET | both | data | List collections and views for a project. |
/api/v1/data | POST | both | data | DataStore ops (set/event/data_batch/view). |
/api/v1/games | GET | both | data | Declared mini-games + live pending counts for a project (the Play chip read). |
/api/v1/games/[game_type]/deck | GET | both | data | The ranked, type-diverse card deck, each item bundled with its referenced objects. |
/api/v1/games/[game_type]/items | POST | both | data | Enqueue/update game items (the PAT twin of the game_queue_upsert MCP tool). |
/api/v1/games/[game_type]/items/[item_id]/resolve | POST | both | data | Resolve one card (like/nope/later) — dispatches the card's declared DashAction; a second resolve returns the stored outcome. |
/api/v1/[resource] | GET | both | data | List a declared resource (cursor-paged). |
/api/v1/[resource] | POST | both | data | Create one object. |
/api/v1/[resource]/[id] | GET | both | data | Fetch one object. |
/api/v1/[resource]/[id] | PATCH | both | data | Merge-patch one object. |
/api/v1/[resource]/[id] | DELETE | both | data | Delete one object. |
/api/v1/[resource]/[id]/events | GET | both | data | An object's timeline events. |
/api/v1/[resource]/[id]/events | POST | both | data | Append a timeline event. |
/api/v1/[resource]/[id]/actions | GET | both | data | Actions available on one object. |
/api/v1/[resource]/[id]/actions | POST | both | data | Run one action on an object. |
/api/v1/[resource]/[id]/image | GET | both | data | Serve an object's stored image. |
/api/v1/[resource]/[id]/image | POST | session | data | Upload an object image. |
/api/v1/[resource]/[id]/image | DELETE | session | data | Remove an object image. |
/api/v1/[resource]/[id]/generate-default-image | POST | session | data | Schedule the default background/icon generation for one object. |
/api/v1/[resource]/[id]/generate-image | POST | session | data | Generate site art for one location (locations only). |
/api/v1/[resource]/counts | GET | session | data | How many rows a resource holds, optionally grouped by a declared filter. |
/api/v1/[resource]/schema | GET | public | — | The published spec for one resource. |
/api/v1/devices/[id]/summary | GET | both | data | Telemetry/vision rollup for one device. |
/api/v1/resources | GET | public | — | Every resource this agent serves. |
/api/v1/workspaces/[id]/metrics | GET | session | — | Resolve registry metrics at workspace scope — one count per key over the workspace's projects, with the daily trend. |
/api/v1/workspaces/[id]/performance | GET | session | — | Read one metric as a day-by-day series across the workspace's projects for the Usage page and the workspace Performance explorer. |
/api/v1/workspaces/[id]/schedulables | GET | session | — | List the workers/schedules behind a usage row (project_id, kind). |
/api/v1/workspaces/[id]/schedules | GET | session | — | List all scheduled tasks/workers in a workspace with cadence, last run, and 7d spend. |
/api/v1/workspaces/[id]/schedules | PATCH | session | — | Apply a preset to one schedule target: pause, resume, daily, weekly, or delete. |
/api/v1/workspaces/[id]/schedules/runs | GET | session | — | Recent runs and spawned child tasks (with costs) for one schedule target. |
/api/v1/reports | GET | session | — | List a workspace's project reports with recent runs. |
/api/v1/reports | POST | session | — | Create a project report (idempotent per project + skill). |
/api/v1/reports/charts | GET | public | — | A report run's chart image (PNG) — ?run=<rrun>&i=<n>&t=<token>; the per-run HMAC token is the authorization. |
/api/v1/reports/runs/[run] | GET | session | — | View a delivered report run in the browser — the same HTML the email carried. |
/api/v1/reports/[id] | GET | session | — | Report detail with its run history. |
/api/v1/reports/[id] | PATCH | session | — | Pause/resume/cadence preset, or launch a run-now report task. |
/api/v1/reports/[id] | DELETE | session | — | Delete the report and disable its schedule worker. |
/api/v1/reports/unsubscribe | GET | public | — | Unsubscribe one recipient from a report (HMAC token). |
/api/v1/reports/unsubscribe | POST | public | — | RFC 8058 one-click unsubscribe (same token contract). |
/api/v1/admin/tickets | GET | session | — | Admin: list user-reported IonWarp tickets with GitHub and review context. |
/api/v1/admin/tickets/[id] | PATCH | session | — | Admin: resolve or reopen a user-reported IonWarp ticket. |
/api/v1/admin/task-run-hubs/purge | POST | session | — | Admin: purge TaskRunHub Durable Objects by id (storage reaper). |
/api/v1/admin/provider-routing | GET | session | — | Admin: read or check the provider-routing cache rows. |
/api/v1/admin/provider-routing | POST | session | — | Admin: force one provider-routing refresh for a model and preset. |
/api/v1/ionwarp/admin/recheck-open-prs | POST | session | — | Admin: re-check open findings on open PRs at their current head. |
/api/v1/admin/runs/[runId]/harness-logs | GET | session | — | Admin: list a run's unexpired model-session harness logs. |
/api/v1/admin/runs/[runId]/harness-logs/[...key] | GET | session | — | Admin: stream one session's harness log (410 once expired). |
/api/v1/admin/benchmarks/blobs/[sha] | GET | both | — | Admin: read one benchmark blob's bytes (?verify=1 re-hashes server-side). |
/api/v1/admin/benchmarks/blobs/[sha] | PUT | both | — | Admin: store one benchmark blob by the sha256 of its raw bytes. |
/api/v1/admin/benchmarks/rows | POST | both | — | Admin: write one atomic batch of benchmark rows ({batch, op_id}). |
/api/v1/admin/benchmarks/rows/[table] | GET | both | — | Admin: read benchmark rows by an index-prefix filter (≤ 500, cursor). |
/api/v1/admin/workspaces/[id]/budgets/[meter] | GET | session | — | Admin: read a workspace's effective cap and persisted override. |
/api/v1/admin/workspaces/[id]/budgets/[meter] | PUT | session | — | Admin: set a workspace's spend cap override (credits meter). |
/api/v1/admin/workspaces/[id]/budgets/[meter] | DELETE | session | — | Admin: remove the override; the plan allowance becomes the cap. |
/api/v1/catalog | GET | public | — | List this agent's LIVE public-catalog cards (agents & GTM packs); employees may also request pending_approval. |
/api/v1/catalog/[slug] | GET | public | — | One catalog entry's full anonymized manifest — live only; pending entries exist solely for dash-platform employees. |
/api/v1/catalog/[slug]/status | POST | session | — | Employee-only status flip (pending_approval→live|revoked, revoked→live) — THE one approval path; publish can only ever create pending entries. |