APP_ORIGIN and require a bearer token or browser owner session. Errors use { "error": { "code": "...", "message": "..." } }; malformed JSON/schema input returns 400 invalid_request, missing resources 404 not_found, invalid/revoked tokens 401 invalid_token, and missing scopes 403 insufficient_scope.
GET /api/health is the unauthenticated liveness check and returns { "ok": true }.
Discovery and read operations
Writes and runs
Job creation requires
name (1–120), slug (lowercase, up to 30), promptTemplate (1–50,000), executionTargetId, and optional model, effort, concurrencyLimit, and triggers. Manual invocation accepts an optional display name (1–120), prompt (default empty), an optional JSON object data (default {}), and an optional unique idempotencyKey (1–200; never prefix it with reserved manual:). The display name is used for the run when supplied; prompt and data are exposed under the manual trigger slug, for example {{trigger-1.data.name}}. Run states are queued, starting, running, recovering, done, blocked, failed, and ignored.