Odin

Appearance

API reference ​

Source commit: e1318eca83a40b9418d873ad85c31686ea6b57d0.

Generated by scripts/docs/generate_api_reference.py; do not edit by hand.

The 237 REST registrations below follow create_api_routes in exact order, using the same route-table mechanism as the parity test. Order matters for overlapping literal and parameter paths. Implicit aiohttp HEAD routes are not counted separately; GET registrations also accept HEAD. Purpose is the first handler-docstring line; — means the handler has no docstring, not a guessed description.

Authentication and authorization ​

The active HTTP middleware policy requires authentication on API routes except /api/auth/login, and makes API access admin-only by default except exact method/resource pairs in SELF_SERVICE_ROUTES. The older ADMIN_ONLY_PREFIXES constant remains in the source but is not the active decision rule: _is_admin_only_path is. The table evaluates that function and follows captured route-local admin_gate helpers and wrapped handlers. “Yes + local” indicates an admin requirement with a local gate. “No” does not mean public: self-service endpoints still enforce authentication and applicable identity, session, and tool restrictions.

This describes the normal authenticated deployment. With no configured tokens (including managed tokens), authentication/admin gates allow development-mode access. HTTP API credentials may be a bearer token or server-side session credential; the HTTP middleware also accepts the historical query-token carrier. WebSockets instead use the bearer subprotocol and reject URL query tokens.

REST routes ​

MethodPathOwning module / handler sourceAdmin-gatedPurpose
POST/api/auth/loginsrc.web.api.securityNo—
POST/api/auth/logoutsrc.web.api.securityNo—
GET/api/auth/sessionsrc.web.api.securityNo—
GET/api/setup/statussrc.web.api.config_adminYesCheck whether first-boot setup is needed.
POST/api/setup/completesrc.web.api.config_adminYesReceive wizard data and report restart-required settings, without restarting.
POST/api/setup/listenersrc.web.api.config_adminYesReauthenticate a raw admin bearer and consent to web.host on next restart.
GET/api/statussrc.web.api.config_adminYes—
GET/api/discord/guildssrc.web.api.config_adminYes—
GET/api/discord/memberssrc.web.api.config_adminYes—
PUT/api/discord/guild/{guild_id}/configsrc.web.api.config_adminYes—
PUT/api/discord/channel/{channel_id}/configsrc.web.api.config_adminYes—
GET/api/health/componentssrc.web.api.config_adminYes—
GET/api/resource-usagesrc.web.api.config_adminYes—
GET/api/tool-streamssrc.web.api.config_adminYes—
GET/api/configsrc.web.api.config_adminYes—
GET/api/config/metasrc.web.api.config_adminYesEvery configuration leaf, and how it reaches the running bot.
POST/api/config/image-modelssrc.web.api.config_adminYesAdopt shipped defaults or pin transaction-current effective strings.
PUT/api/configsrc.web.api.config_adminYes—
GET/api/discord/connectionsrc.web.api.discord_connectionYes + local—
POST/api/discord/connectionsrc.web.api.discord_connectionYes + local—
GET/api/discord/users/{user_id}src.web.api.discord_identityYes + local—
POST/api/restartsrc.web.api.config_adminYes + localCleanly restart the running process, on operator request.
POST/api/sessions/clear-allsrc.web.api.config_adminYes + local—
POST/api/reloadsrc.web.api.config_adminYes—
GET/api/personalitysrc.web.api.config_adminYes—
PUT/api/personalitysrc.web.api.config_adminYes—
POST/api/personality/presetssrc.web.api.config_adminYes—
DELETE/api/personality/presets/{name}src.web.api.config_adminYes—
GET/api/update/checksrc.web.api.self_updateYes—
POST/api/update/applysrc.web.api.self_updateYes—
POST/api/loops/stop-allsrc.web.api.self_updateYes—
POST/api/chatsrc.web.api.sessions_chatNo—
POST/api/executesrc.web.api.sessions_chatNoStateless prompt execution — no session history, no persistence.
GET/api/computersrc.web.api.computerYes—
POST/api/computer/stopsrc.web.api.computerYes—
POST/api/computer/pausesrc.web.api.computerYes—
POST/api/computer/observesrc.web.api.computerYes—
GET/api/computer/evidence/{id}src.web.api.computerYes—
POST/api/computer/exportsrc.web.api.computerYes—
GET/api/computer/download/{id}src.web.api.computerYes—
POST/api/computer/enabledsrc.web.api.computerYes—
POST/api/computer/recoversrc.web.api.computerYes—
POST/api/computer/release_owned_inputsrc.web.api.computerYes—
POST/api/computer/acknowledge_legacysrc.web.api.computerYes—
POST/api/computer/reconcilesrc.web.api.computerYes—
GET/api/sessionssrc.web.api.sessions_chatNo—
GET/api/sessions/token-usagesrc.web.api.sessions_chatYes + local—
GET/api/sessions/activitysrc.web.api.sessions_chatYes + local—
GET/api/sessions/searchsrc.web.api.sessions_chatNo—
GET/api/sessions/{channel_id}src.web.api.sessions_chatNo—
GET/api/sessions/{channel_id}/exportsrc.web.api.sessions_chatNo—
DELETE/api/sessions/{channel_id}src.web.api.sessions_chatNo—
POST/api/sessions/clear-bulksrc.web.api.sessions_chatYes + local—
GET/api/toolssrc.web.api.observabilityYes—
GET/api/tools/statssrc.web.api.observabilityYes—
GET/api/tools/timeoutssrc.web.api.observabilityYes—
PUT/api/tools/timeoutssrc.web.api.observabilityYes—
GET/api/tools/builtinssrc.web.api.observabilityYes—
POST/api/tools/builtins/{name}/enabledsrc.web.api.observabilityYesSingle-purpose per-tool switch (Tools panel). Mutates ONLY the
GET/api/tools/bulkheadssrc.web.api.observabilityYes—
GET/api/pools/sshsrc.web.api.llm_adminYes—
GET/api/pools/httpsrc.web.api.llm_adminYes—
POST/api/pools/ssh/closesrc.web.api.llm_adminYes—
GET/api/usagesrc.web.api.observabilityYes—
GET/api/observability/contextsrc.web.api.observabilityYes—
GET/api/observability/failuressrc.web.api.observabilityYes—
GET/api/usage/totalssrc.web.api.observabilityYes—
GET/api/trajectoriessrc.web.api.sessions_chatYes—
GET/api/trajectories/{filename}src.web.api.sessions_chatYes—
GET/api/trajectories/message/{message_id}src.web.api.sessions_chatYes—
GET/api/trajectories/search/querysrc.web.api.sessions_chatYes—
GET/api/skillssrc.web.api.skills_apiYes—
POST/api/skillssrc.web.api.skills_apiYes—
PUT/api/skills/{name}src.web.api.skills_apiYes—
POST/api/skills/{name}/testsrc.web.api.skills_apiYes—
DELETE/api/skills/{name}src.web.api.skills_apiYes—
GET/api/skills/{name}src.web.api.skills_apiYes—
POST/api/skills/validatesrc.web.api.skills_apiYes—
POST/api/skills/{name}/enablesrc.web.api.skills_apiYes—
POST/api/skills/{name}/disablesrc.web.api.skills_apiYes—
GET/api/skills/{name}/configsrc.web.api.skills_apiYes—
PUT/api/skills/{name}/configsrc.web.api.skills_apiYes—
GET/api/mcp/serverssrc.web.api.integrationsYes—
GET/api/mcp/servers/{name}/toolssrc.web.api.integrationsYes—
POST/api/mcp/serverssrc.web.api.integrationsYes—
DELETE/api/mcp/servers/{name}src.web.api.integrationsYes—
PUT/api/mcp/servers/{name}src.web.api.integrationsYes—
POST/api/mcp/servers/{name}/reconnectsrc.web.api.integrationsYes—
POST/api/mcp/servers/{name}/refresh-toolssrc.web.api.integrationsYes—
GET/api/mcp/statussrc.web.api.integrationsYes—
POST/api/mcp/enabledsrc.web.api.integrationsYes—
POST/api/mcp/limitssrc.web.api.integrationsYesPersist only submitted limits; publication reads them live, without reconnecting.
POST/api/mcp/servers/{name}/enabledsrc.web.api.integrationsYesSingle-purpose per-server switch (panel card toggle).
GET/api/grafana-alerts/statussrc.web.api.integrationsYes—
GET/api/grafana-alerts/historysrc.web.api.integrationsYes—
GET/api/grafana-alerts/rulessrc.web.api.integrationsYes—
POST/api/grafana-alerts/rulessrc.web.api.integrationsYes—
DELETE/api/grafana-alerts/rules/{rule_id}src.web.api.integrationsYes—
GET/api/grafana-alerts/remediationssrc.web.api.integrationsYes—
GET/api/knowledgesrc.web.api.knowledge_memYes—
POST/api/knowledgesrc.web.api.knowledge_memYes—
DELETE/api/knowledge/{source}src.web.api.knowledge_memYes—
POST/api/knowledge/{source}/reingestsrc.web.api.knowledge_memYes—
GET/api/knowledge/searchsrc.web.api.knowledge_memYes—
GET/api/knowledge/{source}/chunkssrc.web.api.knowledge_memYes—
GET/api/knowledge/duplicatessrc.web.api.knowledge_memYes—
POST/api/knowledge/mergesrc.web.api.knowledge_memYes—
GET/api/knowledge/{source}/versionssrc.web.api.knowledge_memYes—
GET/api/knowledge/{source}/versions/{version:\d+}src.web.api.knowledge_memYes—
POST/api/knowledge/{source}/versions/{version:\d+}/restoresrc.web.api.knowledge_memYes—
GET/api/knowledge/{source}/versions/{v1:\d+}/diff/{v2:\d+}src.web.api.knowledge_memYes—
POST/api/knowledge/importsrc.web.api.knowledge_memYes—
GET/api/schedules/statussrc.web.api.schedules_apiYes—
GET/api/schedulessrc.web.api.schedules_apiYes—
POST/api/schedulessrc.web.api.schedules_apiYes—
PUT/api/schedules/{schedule_id}src.web.api.schedules_apiYes—
DELETE/api/schedules/{schedule_id}src.web.api.schedules_apiYes—
POST/api/schedules/{schedule_id}/runsrc.web.api.schedules_apiYes—
POST/api/schedules/{schedule_id}/reset-failuressrc.web.api.schedules_apiYes—
GET/api/schedules/historysrc.web.api.schedules_apiYesGlobal schedule execution history (most recent first).
GET/api/schedules/{schedule_id}/historysrc.web.api.schedules_apiYesExecution history for a specific schedule.
GET/api/schedules/{schedule_id}/statssrc.web.api.schedules_apiYesSummary stats for a specific schedule.
POST/api/schedules/validate-cronsrc.web.api.schedules_apiYes—
GET/api/loopssrc.web.api.agents_loopsYes—
GET/api/loops/{loop_id}src.web.api.agents_loopsYesFull loop configuration plus its durable iteration history.
POST/api/loopssrc.web.api.agents_loopsYes—
DELETE/api/loops/{loop_id}src.web.api.agents_loopsYes—
POST/api/loops/{loop_id}/restartsrc.web.api.agents_loopsYes—
GET/api/agents/modelsrc.web.api.agents_loopsYes—
PUT/api/agents/modelsrc.web.api.agents_loopsYes—
GET/api/agentssrc.web.api.agents_loopsYes—
GET/api/agents/{agent_id}src.web.api.agents_loopsYesFull record for ONE agent — the modal's source.
DELETE/api/agents/{agent_id}src.web.api.agents_loopsYes—
GET/api/agents/{agent_id}/childrensrc.web.api.agents_loopsYes—
GET/api/agents/{agent_id}/lineagesrc.web.api.agents_loopsYes—
GET/api/agents/{agent_id}/descendantssrc.web.api.agents_loopsYes—
GET/api/processessrc.web.api.agents_loopsYes—
DELETE/api/processes/{pid}src.web.api.agents_loopsYes—
GET/api/auditsrc.web.api.observabilityYes—
GET/api/audit/diffssrc.web.api.observabilityYes—
GET/api/audit/verifysrc.web.api.observabilityYes—
GET/api/logs/searchsrc.web.api.observabilityYes—
GET/api/logs/statssrc.web.api.observabilityYes—
GET/api/memorysrc.web.api.knowledge_memYes—
GET/api/memory/{scope}src.web.api.knowledge_memYesEvery key/value in one scope, in ONE request.
GET/api/memory/{scope}/{key}src.web.api.knowledge_memYes—
PUT/api/memory/{scope}/{key}src.web.api.knowledge_memYes—
DELETE/api/memory/{scope}/{key}src.web.api.knowledge_memYes—
POST/api/memory/bulk-deletesrc.web.api.knowledge_memYes—
GET/api/risk/statssrc.web.api.observabilityYes—
GET/api/risk/recentsrc.web.api.observabilityYes—
GET/api/governor/statssrc.web.api.observabilityYes—
GET/api/audit/risksrc.web.api.observabilityYes—
GET/api/permissions/tierssrc.web.api.securityYes—
POST/api/permissions/user/{user_id}/repairsrc.web.api.securityYes—
DELETE/api/permissions/user/{user_id}/repairsrc.web.api.securityYes—
GET/api/permissions/user/{user_id}src.web.api.securityYes—
PUT/api/permissions/user/{user_id}src.web.api.securityYes—
DELETE/api/permissions/user/{user_id}src.web.api.securityYes—
GET/api/codex/statussrc.web.api.codex_adminYes—
POST/api/codex/device-codesrc.web.api.codex_adminYes—
POST/api/codex/device-pollsrc.web.api.codex_adminYes—
POST/api/codex/account/{index}/refreshsrc.web.api.codex_adminYes—
POST/api/codex/account/{index}/activatesrc.web.api.codex_adminYes—
POST/api/codex/reloadsrc.web.api.codex_adminYes—
PUT/api/codex/account/{index}/labelsrc.web.api.codex_adminYes—
DELETE/api/codex/account/{index}src.web.api.codex_adminYes—
GET/api/llm/statussrc.web.api.llm_adminYes—
POST/api/llm/switchsrc.web.api.llm_adminYes—
PUT/api/llm/main-modelsrc.web.api.llm_adminYesSet the main model and persist its provider derived from the ref.
GET/api/llm/datasrc.web.api.llm_adminYes—
GET/api/llm/activesrc.web.api.llm_adminYes—
PUT/api/llm/activesrc.web.api.llm_adminYes—
PUT/api/llm/codex/configsrc.web.api.llm_adminYes—
PUT/api/llm/auxiliary/configsrc.web.api.llm_adminYes—
PUT/api/llm/ollama/configsrc.web.api.llm_adminYes—
PUT/api/openai-compatible/configsrc.web.api.llm_adminYes—
GET/api/context/windowssrc.web.api.llm_adminYes—
POST/api/context/windows/clearsrc.web.api.llm_adminYes—
GET/api/ollama/statussrc.web.api.llm_adminYes—
POST/api/ollama/reloadsrc.web.api.llm_adminYes—
POST/api/ollama/probe-modelssrc.web.api.llm_adminYesFetch models from an arbitrary Ollama base_url — works even when client is disabled.
GET/api/ollama/modelssrc.web.api.llm_adminYes—
POST/api/ollama/modelsrc.web.api.llm_adminYes—
GET/api/openrouter/cataloguesrc.web.api.llm_adminYes—
GET/api/openrouter/models/{author}/{slug}/endpointssrc.web.api.llm_adminYes—
POST/api/openrouter/models/{author}/{slug}/selectsrc.web.api.llm_adminYesPersist a route-derived profile and optional per-model provider pin.
GET/api/openai-compatible/statussrc.web.api.llm_adminYes—
POST/api/openai-compatible/reloadsrc.web.api.llm_adminYes—
GET/api/openai-compatible/modelssrc.web.api.llm_adminYes—
POST/api/openai-compatible/modelsrc.web.api.llm_adminYes—
GET/api/openai-compatible/diagnosticsrc.web.api.llm_adminYesReturn bounded connectivity evidence without exposing credentials.
GET/api/host-accesssrc.web.api.securityYes + local—
PUT/api/host-access/user/{user_id}src.web.api.securityYes + local—
DELETE/api/host-access/user/{user_id}src.web.api.securityYes + local—
PUT/api/host-access/default-policysrc.web.api.securityYes + local—
GET/api/hostssrc.web.api.hostsYes + local—
POST/api/hosts/settingssrc.web.api.hostsYes + local—
GET/api/hosts/public-keysrc.web.api.hostsYes + local—
POST/api/hosts/candidatessrc.web.api.hostsYes + local—
POST/api/hosts/{alias}/import-legacysrc.web.api.hostsYes + local—
POST/api/hosts/candidates/{token}/testsrc.web.api.hostsYes + local—
POST/api/hosts/candidates/{token}/commitsrc.web.api.hostsYes + local—
POST/api/hosts/{alias}/enabledsrc.web.api.hostsYes + local—
GET/api/hosts/{alias}/referencessrc.web.api.hostsYes + local—
DELETE/api/hosts/{alias}src.web.api.hostsYes + local—
POST/api/hosts/{alias}/force-revokesrc.web.api.hostsYes + local—
GET/api/tokenssrc.web.api.securityYes + local—
DELETE/api/tokens/unusable/{index}src.web.api.securityYes + local—
POST/api/tokenssrc.web.api.securityYes + local—
PUT/api/tokens/{user_id}src.web.api.securityYes + local—
POST/api/tokens/{user_id}/regeneratesrc.web.api.securityYes + local—
DELETE/api/tokens/{user_id}src.web.api.securityYes + local—
GET/api/recovery/statssrc.web.api.observabilityYes—
GET/api/recovery/recentsrc.web.api.observabilityYes—
GET/api/freshness/statssrc.web.api.observabilityYes—
GET/api/freshness/recentsrc.web.api.observabilityYes—
GET/api/validation/statssrc.web.api.observabilityYes—
GET/api/learnedsrc.web.api.knowledge_memYes—
DELETE/api/learned/{key}src.web.api.knowledge_memYes—
PUT/api/learned/{key}src.web.api.knowledge_memYes—
GET/api/affordancessrc.web.api.observabilityYes—
GET/api/compression/statssrc.web.api.observabilityYes—
GET/api/startup/diagnosticssrc.web.api.config_adminYes—
GET/api/subsystems/statussrc.web.api.observabilityYes—
GET/api/agent-trajectoriessrc.web.api.sessions_chatYes—
GET/api/agent-trajectories/agent/{agent_id}src.web.api.sessions_chatYes—
GET/api/agent-trajectories/search/querysrc.web.api.sessions_chatYes—
GET/api/agent-trajectories/{filename}src.web.api.sessions_chatYes—
GET/api/outbound-webhookssrc.web.api.integrationsYes—
POST/api/outbound-webhookssrc.web.api.integrationsYes—
PUT/api/outbound-webhooks/{webhook_id}src.web.api.integrationsYes—
DELETE/api/outbound-webhooks/{webhook_id}src.web.api.integrationsYes—
POST/api/outbound-webhooks/{webhook_id}/testsrc.web.api.integrationsYes—
GET/api/outbound-webhooks/statssrc.web.api.integrationsYes—
GET/api/turn-state/turnssrc.web.api.turn_stateYes + local—
GET/api/turn-state/capacity-breakerssrc.web.api.turn_stateYes + local—

Other HTTP and WebSocket routes ​

Registered by HealthServer and setup_websocket; these are outside the REST table, including the /api/ws upgrade endpoint. GET rows also include implicit HEAD registration. No listener is started to generate this inventory.

MethodPathOwning module / handler sourceRegistration / accessPurpose
GET/healthsrc.health.serverHealthServer construction; no API authenticationCombined health endpoint.
GET/health/livesrc.health.serverHealthServer construction; no API authenticationLiveness probe — always 200 if the process is running.
GET/health/readysrc.health.serverHealthServer construction; no API authenticationReadiness probe — 200 only when the bot is fully initialised.
GET/metricssrc.health.serverHealthServer construction; no API authenticationPrometheus metrics endpoint.
POST/webhook/giteasrc.health.serverwebhooks.enabled; handler verifies webhook signature/shared secret—
POST/webhook/grafanasrc.health.serverwebhooks.enabled; handler verifies webhook signature/shared secret—
POST/webhook/genericsrc.health.serverwebhooks.enabled; handler verifies webhook signature/shared secret—
POST/webhook/githubsrc.health.serverwebhooks.enabled; handler verifies webhook signature/shared secret—
POST/webhook/gitlabsrc.health.serverwebhooks.enabled; handler verifies webhook signature/shared secret—
GET/src.health.serverweb.enabled + UI directory exists; no API authenticationRedirect / to /ui/.
GET/ui/{path:.*}src.health.serverweb.enabled + UI directory exists; no API authenticationServe static UI files, defaulting to index.html for SPA routing.
GET/uisrc.health.serverweb.enabled + UI directory exists; no API authenticationRedirect / to /ui/.
GET/api/wssrc.web.websocketweb.enabled + set_bot; authenticated, not admin-only; scoped subscriptionsHandle a WebSocket connection at /api/ws.

Conditional registration ​

The constructor always registers health/metrics, independently of the WebUI and webhook switches. Webhooks are registered only when webhooks.enabled. The UI requires web.enabled and an existing UI directory: it prefers ui/dist when ui/dist/index.html exists, otherwise falls back to ui; if the selected directory is absent, no UI routes are registered. The static file handler falls back to index.html for SPA routing. HealthServer.set_bot adds all REST routes and the WebSocket only when web.enabled; constructing the server alone does not add them. There is no setup_web_api function in this source revision.

Regenerate with python scripts/docs/generate_api_reference.py; verify without writing with python scripts/docs/generate_api_reference.py --check. Generation uses mocked bot dependencies and UI existence checks, never loads runtime configuration or persisted data, and never invokes handlers.

Released under the MIT License.

Odin — a self-hosted execution agent for Discord.