HTTP API

The agent exposes a JSON API plus a WebSocket event stream. The TUI and GUI are clients of this API; there is no /chat HTML — Chat is part of the consoles. MCP is a separate Streamable HTTP surface at /mcp, not a second /api control plane.

All /api/*, /ws/*, and /mcp requests pass through the operator gate when auth is enabled. See Auth.

Status and dashboard

Method	Path	Purpose
GET	/api/status	Project health summary.
GET	/api/dashboard	Health, capacity, active work, delivered tasks.
GET	/api/tooling	Host tooling checklist (GitHub, Grafana/gcx, Kubernetes).
GET	/api/agents	List agent/worker rows.
GET	/api/token-usage	Input/output/cache token counts and cache hit rate per agent.

Configuration

Method	Path	Purpose
GET	/api/config	Read config keys.
PATCH	/api/config	Update config keys.
GET	/api/access	Allowed GitHub users, fallback org, and gate state.
PUT	/api/access	Replace allowed users and/or the fallback org.
GET	/api/credentials	List credentials (metadata only).
GET	/api/credentials/catalog	Known credential kinds.
PUT	/api/credentials	Create or update a credential.
DELETE	/api/credentials/{id}	Delete a credential.
GET/POST	/api/health-checks	List or create health checks.
PATCH/DELETE	/api/health-checks/{id}	Update or delete a health check.
GET/POST	/api/skills	List or create skills.
PATCH/DELETE	/api/skills/{id}	Update or delete a skill.

Workflows

Method	Path	Purpose
GET	/api/workflows	Summary counts by kind and status.
GET	/api/workflows/{kind}	Runs for a kind (?limit=&offset=).
GET	/api/workflows/{kind}/runs/{id}	Run detail + step log.
POST	/api/workflows/{kind}/runs/{id}/terminate	Terminate a run.
POST	/api/workflows/{kind}/runs/{id}/retry	Requeue a failed/terminated run at its failed step.
POST	/api/workflows/{kind}/runs/{id}/complete	Mark a running run done without its remaining steps.
POST	/api/workflows/optimize/trigger	Trigger the optimize workflow.
POST	/api/tasks/sync	Force a GitHub issue sync.

Backlog and board

Method	Path	Purpose
GET/POST	/api/backlog	List or create parked items.
PATCH/DELETE	/api/backlog/{id}	Update or delete a parked item.
POST	/api/backlog/{id}/promote	File an issue from a parked item.
POST	/api/backlog/{id}/attachments	Upload an attachment.
GET/DELETE	/api/backlog/{id}/attachments/{attachment_id}	Download or remove.
GET	/api/board/archive	Archived card keys.
PUT/DELETE	/api/board/archive/{key}	Archive or restore a card.

Operator, chat, and GitHub

Method	Path	Purpose
POST	/api/operator/message	File work from an operator message.
GET/POST	/api/operator/chat	Chat history / send.
POST	/api/operator/chat/stream	Streamed reply (SSE).
POST	/api/operator/chat/stop	Stop an in-flight reply.
POST	/api/operator/chat/clear	Clear the active session.
GET	/api/operator/chat/sessions	List chat sessions.
POST	/api/operator/chat/new	Start a new session. Optional JSON { title, issue }.
POST	/api/operator/chat/decision	Publish a Decision comment (issue, body, optional session_id).
GET/DELETE	/api/operator/chat/session/{session}	Read or delete a session.
GET	/api/classifications	Recent Clef/Clairic answers (?subject_kind=&limit=).
GET	/api/classifications/{kind}/{id}	One subject’s latest classification.
GET	/api/github/preview	Issue/PR preview (?issue= and/or ?pr=).

Memory

Method	Path	Purpose
GET	/api/memory/sessions	List sessions (?issue=&pr=&path=&q=&limit=).
GET	/api/memory/sessions/{id}	Session detail + event range.
GET	/api/memory/sessions/{id}/blob	Stream the session blob.
GET	/api/memory/retrieve	Semantic search over session memory.

Audit and events

Method	Path	Purpose
GET	/api/audit	Paginated audit log.
WS	/ws/stream	Real-time event stream.

/ws/stream emits typed frames (workflow_run_created, workflow_run_changed, task_update, agent_update, config_changed, audit_event, ping/pong, …). The consoles refetch the visible surface when a relevant frame arrives.

MCP

Method	Path	Purpose
POST	/mcp	Streamable HTTP JSON-RPC (JSON or SSE).
GET	/mcp	Legacy server-to-client SSE (sessionful protocol versions).
DELETE	/mcp	End a legacy MCP session.

Same operator gate as /api/*. When MCP is off (the default), these return 404 JSON { "error": "mcp disabled" }. Enable from Config → Settings (mcp_enabled) or STEELFRAME_MCP=1. A missing Mcp-Session-Id is success (stateless 2026-07-28). Host/Origin allowlists are snapshotted at process start; a later external_url change needs a restart. See MCP.