Reference
Authentication
Per-route authentication modes and required scopes.
How each /api/v1/** route authenticates. session = better-auth cookie, pat = Bearer pat_…, both = either, public = none.
| Path | Method | Auth | Scope | Summary |
|---|---|---|---|---|
/api/v1/ionwarp/findings/action | POST | session | — | Disposition one review finding to the ledger's own terminal status (resolved | wontfix). |
/api/v1/client-events | POST | public | — | Forward one browser error/telemetry event to Sentry server-side; returns the real ingest outcome. |
/api/v1/scorecards/scan-attempts | GET | session | — | Newest scorecard scan attempt per scorecard for a project (task-level evidence a scan was tried, even when the run wrote nothing). |
/api/v1/integrations/[id]/links | GET | session | — | Workspace projects with a linked flag for one credential (feeds the multi-project attach dropdown). |
/api/v1/pull-requests/review-latency | GET | session | — | p50/p75 review duration for similar-sized PRs in this workspace over the last 24h (planner-degraded runs excluded and counted). |
/api/v1/pull-requests/reviewer-history | GET | session | — | Per-reviewer delivered run count and last-ran time over this project's completed reviews in the last 30 days. |
/api/v1/views/[viewId]/hover-actions/[actionId]/suggest | POST | both | — | AI menu suggestions for a declared hover action group (server re-reads the declaration; named suggest_timeout/suggest_error failures, no fallback content). |
/api/v1/public/review-stats | GET | public | — | Aggregate review resolution rate (resolved / dispositioned findings) across all IonWarp projects; unpublished below a minimum-sample floor. |
/api/v1/moab/channels/webhook/resend | POST | public | — | Resend delivery webhook (svix-signed): email.sent/delivered/bounced/complained → the outbox ladder. |
/api/v1/moab/links/domains | GET | both | — | Tracking-domain registry rows + derived default (probes pending domains). |
/api/v1/moab/links/domains | POST | both | — | Add, verify, or retire a tracking domain (append-only lifecycle). |
/api/v1/billing/reconcile | POST | session | — | Project the current Stripe subscription state into workspace_billing (webhook-independent activation). |
/api/v1/billing/add-seats | POST | session | — | Purchase additional seats (quantity; prorated on the Stripe subscription). |
/api/v1/tasks | GET | session | — | List tasks for a project (project_id query param). |
/api/v1/tasks | POST | both | project | Create a task (optionally scheduled). |
/api/v1/programs/[page_slug]/apply | POST | public | — | Apply to a declared discount program (delivers to its declared address). |
/api/v1/projects | GET | session | — | List the authenticated user's projects. |
/api/v1/projects | POST | session | — | Create a project. |
/api/v1/projects/[id]/checklists/[definitionId]/run | POST | both | project | Evaluate a daily (Beast Mode) checklist now — starts one beast-mode-checklist run; the result still derives from its published day record. |
/api/v1/projects/[id]/performance | GET | both | project | Read one metric as a day-by-day series (metric, by, from, to, top, mode, f.*) for the Performance chart — count metrics via the DataStore, cost/credits/tokens via the usage ledger. |
/api/v1/projects/[id]/metrics | GET | both | project | Resolve the agent's metric registry for one owner (project or object) and window — the ONE read every metric tile and hover renders. |
/api/v1/projects/[id]/pages/[pageId]/preview | GET | session | project | Render one Moab page (sandbox included) as HTML for the dashboard preview iframe — the same renderer the pages host serves. |
/api/v1/projects/[id]/pages/[pageId]/preview-url | POST | both | project | Mint a short-lived signed preview URL for one page row — the browser-loadable reload target of the page-lab build loop (sandbox run tokens accepted, same door as the data API). |
/api/v1/projects/[id]/share-image | POST | session | — | Publish a project artifact as the public share-card background. |
/api/v1/projects/[id]/share-image | DELETE | session | — | Unpublish a project share-card background. |
/api/v1/data | GET | both | data | List collections and views for a project. |
/api/v1/data | POST | both | data | DataStore ops (set/event/data_batch/view). |
/api/v1/games | GET | both | data | Declared mini-games + live pending counts for a project (the Play chip read). |
/api/v1/games/[game_type]/deck | GET | both | data | The ranked, type-diverse card deck, each item bundled with its referenced objects. |
/api/v1/games/[game_type]/items | POST | both | data | Enqueue/update game items (the PAT twin of the game_queue_upsert MCP tool). |
/api/v1/games/[game_type]/items/[item_id]/resolve | POST | both | data | Resolve one card (like/nope/later) — dispatches the card's declared DashAction; a second resolve returns the stored outcome. |
/api/v1/[resource] | GET | both | data | List a declared resource (cursor-paged). |
/api/v1/[resource] | POST | both | data | Create one object. |
/api/v1/[resource]/[id] | GET | both | data | Fetch one object. |
/api/v1/[resource]/[id] | PATCH | both | data | Merge-patch one object. |
/api/v1/[resource]/[id] | DELETE | both | data | Delete one object. |
/api/v1/[resource]/[id]/events | GET | both | data | An object's timeline events. |
/api/v1/[resource]/[id]/events | POST | both | data | Append a timeline event. |
/api/v1/[resource]/[id]/actions | GET | both | data | Actions available on one object. |
/api/v1/[resource]/[id]/actions | POST | both | data | Run one action on an object. |
/api/v1/[resource]/[id]/image | GET | both | data | Serve an object's stored image. |
/api/v1/[resource]/[id]/image | POST | session | data | Upload an object image. |
/api/v1/[resource]/[id]/image | DELETE | session | data | Remove an object image. |
/api/v1/[resource]/[id]/generate-default-image | POST | session | data | Schedule the default background/icon generation for one object. |
/api/v1/[resource]/[id]/generate-image | POST | session | data | Generate site art for one location (locations only). |
/api/v1/[resource]/counts | GET | session | data | How many rows a resource holds, optionally grouped by a declared filter. |
/api/v1/[resource]/schema | GET | public | — | The published spec for one resource. |
/api/v1/devices/[id]/summary | GET | both | data | Telemetry/vision rollup for one device. |
/api/v1/resources | GET | public | — | Every resource this agent serves. |
/api/v1/workspaces/[id]/performance | GET | session | — | Read one metric as a day-by-day series across the workspace's projects for the Usage page and the workspace Performance explorer. |
/api/v1/workspaces/[id]/schedulables | GET | session | — | List the workers/schedules behind a usage row (project_id, kind). |
/api/v1/workspaces/[id]/schedules | GET | session | — | List all scheduled tasks/workers in a workspace with cadence, last run, and 7d spend. |
/api/v1/workspaces/[id]/schedules | PATCH | session | — | Apply a preset to one schedule target: pause, resume, daily, weekly, or delete. |
/api/v1/workspaces/[id]/schedules/runs | GET | session | — | Recent runs and spawned child tasks (with costs) for one schedule target. |
/api/v1/reports | GET | session | — | List a workspace's project reports with recent runs. |
/api/v1/reports | POST | session | — | Create a project report (idempotent per project + skill). |
/api/v1/reports/[id] | GET | session | — | Report detail with its run history. |
/api/v1/reports/[id] | PATCH | session | — | Pause/resume/cadence preset, or launch a run-now report task. |
/api/v1/reports/[id] | DELETE | session | — | Delete the report and disable its schedule worker. |
/api/v1/reports/actions/[code]/run | POST | session | — | Run a report action code: launches the self-contained task in its project. |
/api/v1/reports/unsubscribe | GET | public | — | Unsubscribe one recipient from a report (HMAC token). |
/api/v1/reports/unsubscribe | POST | public | — | RFC 8058 one-click unsubscribe (same token contract). |
/api/v1/admin/tickets | GET | session | — | Admin: list user-reported IonWarp tickets with GitHub and review context. |
/api/v1/admin/tickets/[id] | PATCH | session | — | Admin: resolve or reopen a user-reported IonWarp ticket. |
/api/v1/admin/task-run-hubs/purge | POST | session | — | Admin: purge TaskRunHub Durable Objects by id (storage reaper). |
/api/v1/admin/workspaces/[id]/budgets/[meter] | GET | session | — | Admin: read a workspace's effective cap and persisted override. |
/api/v1/admin/workspaces/[id]/budgets/[meter] | PUT | session | — | Admin: set a workspace's spend cap override (credits meter). |
/api/v1/admin/workspaces/[id]/budgets/[meter] | DELETE | session | — | Admin: remove the override; the plan allowance becomes the cap. |
/api/v1/catalog | GET | public | — | List this agent's LIVE public-catalog cards (agents & GTM packs); employees may also request pending_approval. |
/api/v1/catalog/[slug] | GET | public | — | One catalog entry's full anonymized manifest — live only; pending entries exist solely for dash-platform employees. |
/api/v1/catalog/[slug]/status | POST | session | — | Employee-only status flip (pending_approval→live|revoked, revoked→live) — THE one approval path; publish can only ever create pending entries. |