| GET | /api/v1/admin/users | internal | Accounts with roles and token expiry · needs admin.users |
| POST | /api/v1/admin/users | internal | Create an account (password by default; technical: token with ttl, scopes) with the repositories it may see {repos} - none by default · needs admin.users |
| DELETE | /api/v1/admin/users/{name} | internal | Remove an account · needs admin.users |
| POST | /api/v1/admin/users/{name}/passwd | internal | Set a password · needs admin.users |
| POST | /api/v1/admin/users/{name}/rename | internal | Rename the account {name}: the id stays, history shows the new name at once; locks, shelves, the inbox, notification settings, workspaces, reviews, conflicts, issues and stations move to the new name (`moved` in the answer); refused while it has a pending wipe (ADR-0034) · needs admin.users |
| GET | /api/v1/admin/authors/remap | internal | Author remaps: revisions without an author id whose author text is {from} show the account {to} (ADR-0034) · needs admin.server |
| POST | /api/v1/admin/authors/remap | internal | Add or replace an author remap {from, to: existing account, repo: name or *}; nothing is rewritten, hashes stay · needs admin.server |
| DELETE | /api/v1/admin/authors/remap | internal | Remove an author remap · query: from, repo · needs admin.server |
| POST | /api/v1/admin/users/{name}/token | internal | Rotate the token of a technical account (optional ttl) · needs admin.users |
| POST | /api/v1/admin/users/{name}/role | internal | Change the role · needs admin.users |
| POST | /api/v1/admin/users/{name}/logout | internal | End all sessions of the account · needs admin.users |
| POST | /api/v1/admin/users/{name}/disable | internal | Disable the account (tokens and sessions refused, workspaces locked: access none); {wipe: true} also removes the project files from all its workspaces (ADR-0035) · needs admin.users |
| POST | /api/v1/admin/users/{name}/enable | internal | Enable a disabled account (its wipe requests are cleared) · needs admin.users |
| POST | /api/v1/admin/users/{name}/wipe | internal | Request removing the project files of {repo} (or *) from the account's workspaces while it has no access (ADR-0035) · needs admin.users |
| DELETE | /api/v1/admin/users/{name}/wipe | internal | Cancel a wipe request (?repo=) · needs admin.users |
| GET | /api/v1/admin/wipes | internal | Wipe requests with their state: pending, or done with host and time · needs admin.users |
| GET | /api/v1/admin/roles | internal | Roles and their permissions · needs admin.roles |
| POST | /api/v1/admin/roles | internal | Create or change a custom role · needs admin.roles |
| DELETE | /api/v1/admin/roles/{name} | internal | Remove a custom role · needs admin.roles |
| POST | /api/v1/admin/users/{name}/custom-role | internal | Assign a custom role · needs admin.roles |
| POST | /api/v1/admin/users/{name}/grant | internal | Grant or revoke single permissions · needs admin.users |
| GET | /api/v1/admin/users/{name}/repos | internal | Repositories the account may see: its own list, the list of its custom role (ADR-0032) · needs admin.users |
| PUT | /api/v1/admin/users/{name}/repos | internal | Replace the account's repository list {repos: ["Name", "Name:role", "*"]}; {wipe_removed: true} also removes the project files of the revoked repositories from the account's workspaces · needs admin.users |
| GET | /api/v1/admin/roles/{name}/repos | internal | Repositories of a custom role · needs admin.roles |
| PUT | /api/v1/admin/roles/{name}/repos | internal | Replace the repositories of a custom role {repos: [...]} · needs admin.roles |
| GET | /api/v1/admin/access | internal | Access check: per repository - visible and why, the role there, the permissions · query: user, repo · needs admin.users |
| GET | /api/v1/admin/protections | internal | Path protections (read/write restrictions) · needs admin.roles |
| PUT | /api/v1/admin/protections | internal | Replace path protections · needs admin.roles |
| GET | /api/v1/admin/pats | internal | Personal access tokens with scopes and expiry · needs admin.users |
| POST | /api/v1/admin/pats | internal | Issue a PAT {name, user, scopes, ttl?, repos?} - the token is shown once · needs admin.users |
| POST | /api/v1/admin/scribe/rebuild | internal | Ask the server to rebuild a repository's Scribe index (in the background) · query: repo · needs admin.server |
| GET | /api/v1/admin/maintenance | internal | Maintenance mode state · needs admin.server |
| POST | /api/v1/admin/maintenance | internal | Turn maintenance mode on {reason} · needs admin.server |
| DELETE | /api/v1/admin/maintenance | internal | Turn maintenance mode off · needs admin.server |
| DELETE | /api/v1/admin/pats/{name} | internal | Revoke a PAT · needs admin.users |
| GET | /api/v1/admin/audit | internal | Audit log entries · query: limit, event, user, denied, before, since_ms, until_ms, resource, channel, repo, outcome · needs admin.audit |
| GET | /api/v1/admin/telemetry | internal | Client timings and errors (ADR-0019) · query: days · needs admin.audit |
| GET | /api/v1/admin/audit/verify | internal | Verify the audit hash chain · needs admin.audit |
| GET | /api/v1/admin/audit/{id} | internal | One audit entry (seq or au-*) with verified: hash, signature and link to the previous entry · needs admin.audit |
| GET | /api/v1/admin/config/validate | internal | Check server.toml, ci.toml and users.toml: errors per file, warnings, settings that need a restart · needs admin.server |
| POST | /api/v1/admin/config/reload | internal | Check the configuration and apply what works without a restart (422 and nothing applied on errors) · needs admin.server |
| GET | /api/v1/admin/protection | internal | Connection protection (ADR-0039): [protection] settings, rejection counters, banned addresses, login lockouts · needs admin.server |
| PATCH | /api/v1/admin/protection | internal | Change [protection] settings at once (saved in server.toml; audited protection.settings) · needs admin.server |
| POST | /api/v1/admin/protection/unban | internal | Lift the ban of an address {ip} (audited protection.unbanned) · needs admin.server |
| GET | /api/v1/admin/settings | internal | Every server setting: effective value, source (flag, server.toml, env, default), when a change applies (restart, reload, panel) and whether the panel can change it · needs admin.server |
| PUT | /api/v1/admin/config | internal | Change a setting that config reload applies {key, value}: written to server.toml, checked, reloaded (422 and server.toml restored on errors; value null = default) · needs admin.server |
| GET | /api/v1/admin/status | internal | Server status for the dashboard · needs admin.server |
| GET | /api/v1/admin/license | internal | Server license (ADR-0029): state and reason, licensee, dates, limits, instance fingerprint, last check-in, lease · needs admin.server |
| PUT | /api/v1/admin/license | internal | Install a license key {key}: verified offline, saved to the license file, check-in in the background (422 for an invalid key) · needs admin.server |
| POST | /api/v1/admin/license/checkin | internal | License check-in now; the state afterwards with checkin_ok and checkin_error · needs admin.server |
| POST | /api/v1/admin/license/release | internal | Release this server instance at the license server (moving to another machine): the key file is moved to <file>.released and the server becomes unlicensed; installing a key registers it again (502 when the license server refuses or is unreachable, 409 for a key in server.toml) · needs admin.server |
| GET | /api/v1/admin/stations | internal | Client stations seen in the last 30 days (ADR-0029): account, computer name, OS user, IP, OS, client version, product, first and last seen; the station limit from the license · needs admin.server |
| DELETE | /api/v1/admin/stations/{key} | internal | Free a station's place (account@computer); it counts as new on its next use · needs admin.server |
| GET | /api/v1/admin/repairs | internal | Repair tasks (ADR-0035): newest first, filters ?account= and ?host=; state pending/delivered/done/rejected/expired/cancelled and the station's result · needs admin.server |
| POST | /api/v1/admin/repairs | internal | Create a repair task for a station {account, hostname, repo, kind: tq|script, commands | script {name, body}, note}; signed with the instance key, runs on the station without asking the user · needs admin.server |
| GET | /api/v1/admin/repairs/{id} | internal | One repair task with its full content (script body) and signature · needs admin.server |
| DELETE | /api/v1/admin/repairs/{id} | internal | Cancel a repair task that has not reached the station yet (pending) · needs admin.server |
| GET | /api/v1/admin/diagnostics | internal | Diagnostics bundles (ADR-0036): account, host, time, product, version, reason, size, repo; filters ?account=, ?host=, ?repo= · needs admin.server |
| POST | /api/v1/admin/diagnostics/request | internal | Ask a station for a diagnostics bundle {account, hostname, repo?, note?}; delivered at its next contact, expires after 7 days · needs admin.server |
| DELETE | /api/v1/admin/diagnostics/request | internal | Cancel a pending diagnostics request (?account=&hostname=) · needs admin.server |
| GET | /api/v1/admin/diagnostics/requests | internal | Pending diagnostics requests · needs admin.server |
| GET | /api/v1/admin/diagnostics/{id} | internal | One diagnostics bundle: metadata, a readable summary and the JSON · needs admin.server |
| DELETE | /api/v1/admin/diagnostics/{id} | internal | Delete a diagnostics bundle · needs admin.server |
| GET | /api/v1/admin/diagnostics/{id}/download | internal | Download a diagnostics bundle as a JSON file · needs admin.server |
| PATCH | /api/v1/admin/repos/{repo}/channels/{channel} | internal | Set a channel's parent and/or type (body {parent?, type?}; parent null = none, only for main and release; the parent must be an open, non-virtual channel not based on this one). For channels created before v0.4.0, which have no parent on the server; audited as channel.updated · needs admin.server |
| POST | /api/v1/repos/{repo}/channels/{channel}/rewind | internal | Remove the revisions after `to` from a channel's history (ADR-0031; global server-admin role, audited; body {to, reason, dry_run, expected_head, affected_channels, record_manual, from_hash, hashes, from_seq}) · needs channel.rewind |
| GET | /api/v1/repos/{repo}/channels/{channel}/rewinds | internal | Revisions removed from a channel by an administrator, newest first, with reason and author (ADR-0031), the copies that had them and the protection state (ADR-0037) · query: limit · needs channel.rewind |
| POST | /api/v1/repos/{repo}/channels/{channel}/rewinds/{id}/allow-content | internal | Allow the content removed by a rewind back: pushes with it stop being refused; the revisions stay removed (ADR-0037) · needs channel.rewind |
| GET | /api/v1/admin/workspaces | internal | Workspaces of every account in the repositories where the caller has workspace.list-all (role in that repository), elsewhere the caller's own; each entry carries can{list_all, edit_any, force_unlock}; 403 without workspace.list-all anywhere (admin panel) · needs repo.read |
| GET | /api/v1/repos/{repo}/scribe/symbols | stable | Symbols of a file (also Blueprints) · query: path, rev · needs scribe.read |
| GET | /api/v1/repos/{repo}/scribe/blame | stable | History of a symbol across renames and moves · query: symbol · needs scribe.read |
| GET | /api/v1/repos/{repo}/scribe/trace | experimental | Full lineage of a symbol · query: symbol · needs scribe.read |
| POST | /api/v1/repos/{repo}/scribe/link | experimental | Link two symbols by hand {newer, older} (resolves Ambiguous) · needs repo.write |
| DELETE | /api/v1/repos/{repo}/scribe/link | experimental | Remove a manual link · query: symbol · needs repo.write |
| GET | /api/v1/repos/{repo}/scribe/search | experimental | Find symbols by name (exact, prefix, substring; case-insensitive) · query: q, kind, lang, path, rev · needs scribe.read |
| GET | /api/v1/repos/{repo}/scribe/usages | experimental | Where a symbol or asset is used (code and Blueprint nodes) · query: symbol, rev · needs scribe.read |
| GET | /api/v1/repos/{repo}/scribe/timeline | experimental | Names, files and authors of a symbol over time · query: symbol · needs scribe.read |
| GET | /api/v1/repos/{repo}/scribe/diff | experimental | Semantic diff of two revisions: symbols added, removed, changed, renamed, moved · query: from, to, path · needs scribe.read |
| GET | /api/v1/repos/{repo}/scribe/annotate | experimental | Per-symbol blame of a file · query: path, rev · needs scribe.read |
| GET | /api/v1/repos/{repo}/scribe/relations | experimental | Typed links of a symbol (must-sync, derived-from, replaces, depends-on) · query: symbol · needs scribe.read |
| GET | /api/v1/repos/{repo}/scribe/notes | experimental | Notes attached to a symbol · query: symbol · needs scribe.read |
| POST | /api/v1/repos/{repo}/scribe/notes | experimental | Attach a note to a symbol {symbol, tag, note} · needs repo.write |
| DELETE | /api/v1/repos/{repo}/scribe/notes | experimental | Remove a note · query: symbol, tag · needs repo.write |