| GET | / | internal | Landing page (HTML) linking the admin panel, API docs and health |
| GET | /admin | internal | Admin panel (single HTML page; it calls the admin API with a token) |
| GET | /health | stable | Liveness with version and uptime (old address) deprecated since 2026-10-11, sunset Fri, 01 Oct 2027 00:00:00 GMT; use /api/v1/health |
| GET | /healthz | stable | Process is alive (always 200, no details) |
| GET | /readyz | stable | Ready for traffic: metadata store answers, data directory writable, no maintenance (503 with a reason otherwise) |
| GET | /api/v1/health | stable | Liveness with version and uptime |
| GET | /api/v1/openapi.json | stable | This specification (OpenAPI 3.0) |
| GET | /api/v1/docs | stable | Human-readable list of endpoints (HTML, no external assets) |
| GET | /metrics | experimental | Prometheus metrics · needs admin.server |
| GET | /api/v1/admin/users | internal | Accounts with roles and token expiry · needs admin.users |
| POST | /api/v1/admin/users | internal | Create an account (password by default; technical: token with ttl, scopes, repos) · needs admin.users |
| DELETE | /api/v1/admin/users/{name} | internal | Remove an account · needs admin.users |
| POST | /api/v1/admin/users/{name}/passwd | internal | Set a password · needs admin.users |
| POST | /api/v1/admin/users/{name}/token | internal | Rotate the token of a technical account (optional ttl) · needs admin.users |
| POST | /api/v1/admin/users/{name}/role | internal | Change the role · needs admin.users |
| POST | /api/v1/admin/users/{name}/logout | internal | End all sessions of the account · needs admin.users |
| GET | /api/v1/admin/roles | internal | Roles and their permissions · needs admin.roles |
| POST | /api/v1/admin/roles | internal | Create or change a custom role · needs admin.roles |
| DELETE | /api/v1/admin/roles/{name} | internal | Remove a custom role · needs admin.roles |
| POST | /api/v1/admin/users/{name}/custom-role | internal | Assign a custom role · needs admin.roles |
| POST | /api/v1/admin/users/{name}/grant | internal | Grant or revoke single permissions · needs admin.users |
| GET | /api/v1/admin/protections | internal | Path protections (read/write restrictions) · needs admin.roles |
| PUT | /api/v1/admin/protections | internal | Replace path protections · needs admin.roles |
| GET | /api/v1/admin/pats | internal | Personal access tokens with scopes and expiry · needs admin.users |
| POST | /api/v1/admin/pats | internal | Issue a PAT {name, user, scopes, ttl?, repos?} - the token is shown once · needs admin.users |
| POST | /api/v1/admin/scribe/rebuild | internal | Ask the server to rebuild a repository's Scribe index (in the background) · query: repo · needs admin.server |
| GET | /api/v1/admin/maintenance | internal | Maintenance mode state · needs admin.server |
| POST | /api/v1/admin/maintenance | internal | Turn maintenance mode on {reason} · needs admin.server |
| DELETE | /api/v1/admin/maintenance | internal | Turn maintenance mode off · needs admin.server |
| DELETE | /api/v1/admin/pats/{name} | internal | Revoke a PAT · needs admin.users |
| GET | /api/v1/admin/audit | internal | Audit log entries · query: limit, event, user, denied, before, since_ms, until_ms, resource, channel, repo, outcome · needs admin.audit |
| GET | /api/v1/admin/telemetry | internal | Client timings and errors (ADR-0019) · query: days · needs admin.audit |
| GET | /api/v1/admin/audit/verify | internal | Verify the audit hash chain · needs admin.audit |
| GET | /api/v1/admin/audit/{id} | internal | One audit entry (seq or au-*) with verified: hash, signature and link to the previous entry · needs admin.audit |
| GET | /api/v1/admin/config/validate | internal | Check server.toml, ci.toml and users.toml: errors per file, warnings, settings that need a restart · needs admin.server |
| POST | /api/v1/admin/config/reload | internal | Check the configuration and apply what works without a restart (422 and nothing applied on errors) · needs admin.server |
| GET | /api/v1/admin/status | internal | Server status for the dashboard · needs admin.server |
| GET | /api/v1/repos/{repo}/tree/{rev} | experimental | All files at a revision (HEAD, number or commit hash) with size and blob hash · needs repo.read |
| GET | /api/v1/repos/{repo}/file/{rev} | experimental | File content at a revision (text preview) · query: path · needs repo.read |
| GET | /api/v1/repos/{repo}/filediff/{rev} | experimental | Diff of one file against the parent commit or base · query: path, base · needs repo.read |
| GET | /api/v1/repos/{repo}/diff/{rev} | experimental | Files changed by a revision against the parent commit or base · query: base · needs repo.read |
| GET | /api/v1/repos/{repo}/raw/{rev} | stable | Raw bytes of a file (application/octet-stream), outside the request limit · query: path · needs repo.read |
| GET | /api/v1/repos/{repo}/webhooks | stable | Webhook subscriptions · needs webhook.manage |
| POST | /api/v1/repos/{repo}/webhooks | stable | Subscribe {url, events, channels?, secret?, kind?} - HMAC-SHA256 signed deliveries · needs webhook.manage |
| DELETE | /api/v1/repos/{repo}/webhooks/{id} | stable | Delete a subscription · needs webhook.manage |
| GET | /api/v1/repos/{repo}/webhooks/{id}/deliveries | stable | Delivery attempts of a subscription · needs webhook.manage |
| POST | /api/v1/repos/{repo}/webhooks/{id}/redeliver/{seq} | stable | Deliver an event again · needs webhook.manage |
| GET | /api/v1/repos/{repo}/scribe/symbols | stable | Symbols of a file (also Blueprints) · query: path, rev · needs scribe.read |
| GET | /api/v1/repos/{repo}/scribe/blame | stable | History of a symbol across renames and moves · query: symbol · needs scribe.read |
| GET | /api/v1/repos/{repo}/scribe/trace | experimental | Full lineage of a symbol · query: symbol · needs scribe.read |
| POST | /api/v1/repos/{repo}/scribe/link | experimental | Link two symbols by hand {newer, older} (resolves Ambiguous) · needs repo.write |
| DELETE | /api/v1/repos/{repo}/scribe/link | experimental | Remove a manual link · query: symbol · needs repo.write |
| GET | /api/v1/repos/{repo}/scribe/search | experimental | Find symbols by name (exact, prefix, substring; case-insensitive) · query: q, kind, lang, path, rev · needs scribe.read |
| GET | /api/v1/repos/{repo}/scribe/usages | experimental | Where a symbol or asset is used (code and Blueprint nodes) · query: symbol, rev · needs scribe.read |
| GET | /api/v1/repos/{repo}/scribe/timeline | experimental | Names, files and authors of a symbol over time · query: symbol · needs scribe.read |
| GET | /api/v1/repos/{repo}/scribe/diff | experimental | Semantic diff of two revisions: symbols added, removed, changed, renamed, moved · query: from, to, path · needs scribe.read |
| GET | /api/v1/repos/{repo}/scribe/annotate | experimental | Per-symbol blame of a file · query: path, rev · needs scribe.read |
| GET | /api/v1/repos/{repo}/scribe/relations | experimental | Typed links of a symbol (must-sync, derived-from, replaces, depends-on) · query: symbol · needs scribe.read |
| GET | /api/v1/repos/{repo}/scribe/notes | experimental | Notes attached to a symbol · query: symbol · needs scribe.read |
| POST | /api/v1/repos/{repo}/scribe/notes | experimental | Attach a note to a symbol {symbol, tag, note} · needs repo.write |
| DELETE | /api/v1/repos/{repo}/scribe/notes | experimental | Remove a note · query: symbol, tag · needs repo.write |