Gateway API

The single-user gateway is an authenticated local HTTP service. Its normal origin is:

http://127.0.0.1:18790

It must remain loopback-only.

Authentication

Loading / from a browser sets an HttpOnly, same-site bootstrap cookie. Cookie-authenticated mutations require an exact matching scheme, host, and port origin.

Scripts use the per-state bearer token:

Authorization: Bearer <token>

The token is an owner-only control-plane secret. Never place it in browser code, documentation, logs, or a public environment variable.

Common reads

• /status — runtime and configuration health
• /diagnostics — redacted diagnostic report
• /sessions, /projects, /goals, /memory — durable user records
• /runs, /tasks, /jobs — execution state
• /audit, /audit/query, /audit/verify, /usage — operational history
• /cron — scheduled jobs
• /agents, /skills — package registries
• /improvements — automatic improvement records

Mutations

Create, update, decision, replay, cancel, and lifecycle endpoints require authentication. Cookie clients also require origin validation. Idempotency keys are bound to canonical request content; reusing a key for different content is rejected.

Streaming

The gateway supports streamed runtime responses and reconnectable audit events. Clients must handle interruption without assuming an external action did or did not occur.

Advanced: Labs route families

Enabled Labs expose authenticated route families for runtime runs, Proof, policy evaluation, capabilities, checkpoints and Rewind, Capsules, Counterfactuals, and routing observations. Each route remains unavailable until its matching feature flag was enabled before gateway startup.

Use the corresponding Labs guide rather than probing arbitrary URLs.

Errors

Runtime errors include a stable request correlation value in the response header and body. Public responses are sanitized; sensitive internal details remain out of the payload.

For remote deployment, do not proxy this gateway directly. Use Remote hosting.