Endpoints

Every operation in api/openapi.yaml (API version 2026-10-01), the file a test keeps equal to the server’s mounted routes. Each links to its full reference: parameters, request body, responses and examples.

People

Signing in with an emailed link or code (no passwords), sessions, your org and its members (docs/IDENTITY.md).

Method	Path	What it does
POST	/v1/auth/login	Ask for a sign-in link and code
POST	/v1/auth/preview	See what a sign-in link would do, without using it
POST	/v1/auth/callback	Sign in with a link’s token, or with an email address and code
POST	/v1/auth/logout	Sign out
POST	/v1/auth/switch-org	Switch to another org you belong to
GET	/v1/me	Who is signed in
PATCH	/v1/me	Change your name
GET	/v1/org	Get your org
PATCH	/v1/org	Change the org’s name, time zone, payload retention or approval settings
GET	/v1/org/members	List the org’s members
POST	/v1/org/members	Invite someone
PATCH	/v1/org/members/{id}	Change a member’s role
DELETE	/v1/org/members/{id}	Remove a member, or leave

Agents

Agents, their API keys, Stop and Stop all (docs/AGENTS.md). Control-plane routes accept a Console session (by role) or an org admin key (admin scope). Agent keys get 403 insufficient_scope on all of them: no agent key changes any agent, including its own. A 401 carries WWW-Authenticate: Bearer realm="deedglass", error="invalid_token", error_description="…"; a 403 insufficient_scope carries WWW-Authenticate: Bearer realm="deedglass", error="insufficient_scope", scope="…". Every change seals an admin deed.

Method	Path	What it does
GET	/v1/agents	List agents
POST	/v1/agents	Create an agent
GET	/v1/agents/{id}	Get an agent
PATCH	/v1/agents/{id}	Change an agent’s description, labels, budgets, owner or intent mode
POST	/v1/agents/{id}/suspend	Suspend an agent
POST	/v1/agents/{id}/resume	Resume a suspended agent
POST	/v1/agents/{id}/stop	Stop an agent
POST	/v1/agents/{id}/start	Start a stopped agent
GET	/v1/agents/{id}/keys	List an agent’s API keys
POST	/v1/agents/{id}/keys	Create an API key for an agent
GET	/v1/agents/{id}/intent-keys	List an agent’s intent keys
POST	/v1/agents/{id}/intent-keys	Register an intent key for an agent
DELETE	/v1/agents/{id}/intent-keys/{kid}	Remove an intent key
POST	/v1/keys/{id}/roll	Roll an API key
POST	/v1/keys/{id}/revoke	Revoke an API key
POST	/v1/org/stop-all	Stop every agent in the org
POST	/v1/org/start-all	Turn off Stop all
GET	/v1/org/keys	List the org’s admin keys
POST	/v1/org/keys	Create an org admin key
GET	/v1/whoami	Which key, agent and org this is

Pages

The server-rendered sign-in pages and the Console.

Method	Path	What it does
GET	/approve	The page an approval link opens
GET	/approve/assets/{file}	The approval page’s stylesheet and script
GET	/login	The sign-in page
GET	/auth/confirm	The page a sign-in link opens
GET	/app	The Console’s Overview page
GET	/app/{path...}	A Console page or asset
GET	/auth/assets/{file}	The sign-in pages’ stylesheet and script

System

Health, version and this document.

Method	Path	What it does
GET	/v1/health	Check the server and its database
GET	/v1/version	Show the server’s version and API versions
GET	/api/openapi.yaml	Download this document

Ledger

The searchable history of every action an agent took and every state change, and the deed chain check (docs/LEDGER.md).

Method	Path	What it does
GET	/v1/actions	List actions
GET	/v1/actions/{id}	Show one action, its events and deeds
GET	/v1/ledger/check	Check the deed chain

Events

The live event stream (Server-Sent Events) the Console and deedglass actions list --follow read (docs/EVENTS.md).

Method	Path	What it does
GET	/v1/events	Stream live events (Server-Sent Events)

Overview

The Console’s first screen as numbers: actions, blocks, verdicts, approvals, the most active agents and what needs a person (docs/OVERVIEW_METRICS.md).

Method	Path	What it does
GET	/v1/overview	Get the overview

Gate

Sending actions through the Gate, cancelling one that waits for approval, and reporting the result of a proxy-mode action (docs/GATE.md).

Method	Path	What it does
POST	/v1/actions	Send an action through the Gate
POST	/v1/actions/{id}/cancel	Cancel an action waiting for approval
POST	/v1/actions/{id}/undo/preview	Preview an undo
POST	/v1/actions/{id}/undo	Undo an action
POST	/v1/actions/{id}/result	Report the result of a proxy-mode action
GET	/v1/tools	The native tools this agent may see
POST	/v1/tools/resolve	Which of an edge’s tools the policy always denies

Observe

Observe mode: watched sessions over a Postgres connector’s change log, their seal, the free undo SQL and the one-step session undo (Pro) (docs/OBSERVE.md).

Method	Path	What it does
GET	/v1/observe/sessions	List watched sessions
POST	/v1/observe/sessions	Open a watched session
GET	/v1/observe/sessions/{id}	Get a watched session
POST	/v1/observe/sessions/{id}/close	Close a watched session
POST	/v1/observe/sessions/{id}/frames/{dtx}/exclude	Leave a transaction out of a session’s undo
GET	/v1/observe/sessions/{id}/undo_preview	Preview a session’s undo
POST	/v1/observe/sessions/{id}/undo	Undo a watched session in one step (Pro)

Deeds

Signed records of what agents did, and the public seal keys that check them offline (docs/DEED_SPEC.md).

Method	Path	What it does
GET	/.well-known/deedglass/keys.json	List the public seal keys
GET	/v1/deeds	List deeds
GET	/v1/deeds/{id}	Get one deed’s exact bytes
POST	/v1/deeds/files	Seal a file you hold
GET	/v1/deeds/export	Export deeds as a bundle

Intents

Signed intents: the conformance check SDK authors run against Deedglass.

Method	Path	What it does
POST	/v1/intents/verify	Check a signed intent without acting

Policies

Policies and their immutable versions, activation as enforce or shadow (each sealed as an admin deed), and the lint, dry-run and test tools (docs/POLICY_LANGUAGE.md). Every route accepts a Console session (by role) or an org admin key (admin scope). Agent keys get 403 insufficient_scope on all of them, reads included.

Method	Path	What it does
GET	/v1/policies	List policies
POST	/v1/policies	Create a policy from its YAML
GET	/v1/policies/active	Show the enforced and shadow policies
GET	/v1/policies/{id}	Get a policy
GET	/v1/policies/{id}/versions	List a policy’s versions
POST	/v1/policies/{id}/versions	Push a new version of a policy
GET	/v1/policies/{id}/versions/{v}	Get one version of a policy, with its source
POST	/v1/policies/{id}/versions/{v}/activate	Enforce a version, or run it in shadow
POST	/v1/policies/{id}/versions/{v}/deactivate	Switch off the shadow policy
POST	/v1/policies/lint	Check a policy’s YAML without saving it
POST	/v1/policies/evaluate	Dry-run one action against a policy
POST	/v1/policies/test	Run test cases against a policy

Connectors

Connectors turn an API into governed tools, and hold its credential (docs/CONNECTORS.md). Credentials are write-only: no route returns a value, only the kind, the field names and a short hint. Every route accepts a Console session (viewers read, admins change) or an org admin key (admin scope); agent keys get 403 insufficient_scope on all of them, reads included. Every change seals an admin deed.

Method	Path	What it does
GET	/v1/connectors	List connectors
POST	/v1/connectors	Add a connector
GET	/v1/connectors/{id}	Get a connector
PATCH	/v1/connectors/{id}	Update a connector
DELETE	/v1/connectors/{id}	Delete a connector
PUT	/v1/connectors/{id}/credentials	Store a connector’s credentials
DELETE	/v1/connectors/{id}/credentials	Delete a connector’s credentials
POST	/v1/connectors/{id}/test	Test a connector
POST	/v1/connectors/{id}/initialized	Record a Postgres database setup
GET	/v1/connectors/{id}/decoder	Show a connector’s decoder
DELETE	/v1/connectors/{id}/decoder	Drop a connector’s slot
GET	/v1/connector-types	List connector types
GET	/v1/connector-types/{type}	Get one connector type

Insights

What your history says (docs/INSIGHTS.md): replaying a policy version over past decisions, where the shadow policy disagrees with the enforced one, decision and verdict stats, and anomaly episodes for a person to review. Insights reads and reports; its only input into decisions is the opt-in anomaly facts. Every route accepts a Console session (viewers read, admins change) or an org admin key (admin scope); agent keys get 403 insufficient_scope on all of them, reads included.

Method	Path	What it does
POST	/v1/policies/{id}/versions/{v}/replay	Replay a policy version over past actions
GET	/v1/replays	List replays
GET	/v1/replays/{id}	Retrieve a replay
POST	/v1/replays/{id}/cancel	Cancel a replay
GET	/v1/suggestions	List suggestions
POST	/v1/suggestions/generate	Generate suggestions now
GET	/v1/suggestions/{id}	Retrieve a suggestion
POST	/v1/suggestions/{id}/accept	Accept a suggestion into shadow
POST	/v1/suggestions/{id}/reject	Reject a suggestion
GET	/v1/insights/stats	Get decision and verdict stats
GET	/v1/insights/shadow	Get the shadow disagreement report
GET	/v1/insights/anomalies	List anomalies
GET	/v1/insights/anomalies/{id}	Retrieve an anomaly
POST	/v1/insights/anomalies/{id}/acknowledge	Acknowledge an anomaly
POST	/v1/insights/anomalies/{id}/resolve	Resolve an anomaly
GET	/v1/insights/settings	Get Insights settings
PATCH	/v1/insights/settings	Change Insights settings

MCP

MCP authorization readiness: OAuth protected-resource metadata (RFC 9728) and the /mcp endpoints.

Method	Path	What it does
GET	/.well-known/oauth-protected-resource	Show the protected-resource metadata for the API
GET	/.well-known/oauth-protected-resource/mcp/{connector}	Show the protected-resource metadata for a connector’s MCP endpoint
GET	/.well-known/oauth-protected-resource/mcp/native	Show the protected-resource metadata for the native MCP endpoint
POST	/mcp/{connector}	Send an MCP message to an upstream MCP server through the Gate
POST	/mcp/native	Send an MCP message to the Gate’s native tools

Approvals

Method	Path	What it does
GET	/v1/approvals	List approvals
GET	/v1/approvals/{id}	Retrieve an approval
POST	/v1/approvals/{id}/approve	Countersign an approval
POST	/v1/approvals/{id}/deny	Deny an approval
POST	/v1/approval-links/preview	Show the approval behind an emailed link
POST	/v1/approval-links/decide	Decide with an emailed link
POST	/v1/approval-links/status	Follow a decided action from its link
POST	/v1/slack/interact	Slack interactivity (approve and deny from an approval card)

Webhooks

Method	Path	What it does
GET	/v1/webhooks	List webhook endpoints
POST	/v1/webhooks	Create a webhook endpoint
GET	/v1/webhooks/{id}	Retrieve a webhook endpoint
DELETE	/v1/webhooks/{id}	Delete a webhook endpoint
POST	/v1/webhooks/{id}/test	Send a test event
GET	/v1/webhooks/{id}/deliveries	List an endpoint’s deliveries