API Reference

This reference documents all 426 HTTP endpoints exposed by the Open ACE backend, grouped by path family. Paths are the full externally visible routes, with blueprint URL prefixes already folded in. Route parameters use Flask syntax (<int:user_id>, <path:filename>, ...).

Base URL and authentication

Base URL. The server listens on port 19888 by default, so the API root is http://<host>:19888/api. All business routes live under the /api prefix; health probes and SPA routes live at the application root.

Session token (primary authentication). Most endpoints authenticate the current user via the session token, provided either as:

• the session_token cookie (set by POST /api/auth/login), or
• the Authorization: Bearer <token> header.

API keys and service tokens. A few route groups use dedicated credentials instead of (or on top of) the session token:

• POST /api/upload/* requires the X-Upload-Auth header carrying the UPLOAD_AUTH_KEY value; the endpoints return 503 when the key is not configured and 401 when it does not match.
• Remote agents authenticate with machine registration/agent tokens (/api/remote/agent/*, /api/remote/usage-report); see ../guide/REMOTE_AGENT.md.
• GET /api/quota/webui-check accepts the webui token used by the webui backend middleware.
• The /api/api-keys family manages provider API keys stored encrypted in the database and consumed by the LLM proxy endpoints — they are not Open ACE login credentials.

Roles. Elevated endpoints require admin-level roles (admin, platform_admin, tenant_admin). The authoritative per-endpoint listing is API_PERMISSION_MATRIX.md; the role model is described in PERMISSION_MODEL.md.

Auth column legend. The Auth column reproduces the route's permission decorators verbatim from the source; - means no permission decorator:

Decorator	Meaning
public_endpoint	Explicitly public; no authentication required.
require_upload_auth	Upload collector endpoints guarded by the X-Auth-Key header instead of a session.
-	No permission decorator declared; the handler may still resolve the session or use dedicated credentials (upload key, agent token).
auth_required	Valid session required.
admin_required	Admin role required (legacy platform-level admin).
platform_admin_required	Platform admin role required.
api_key_admin_required	Tenant/platform admin authorized for API-key management.
any_admin_required	Any admin role (platform, tenant or legacy admin).
tenant_member_required	Tenant member required.
same_tenant_user_required	Target user must belong to the caller's tenant (stacked with admin_required).
same_tenant_or_platform_admin	Same-tenant admin or platform admin.
machine_access_required	System admin or user assigned to the machine.
machine_admin_required	System admin or machine admin.

Global conventions

• Content type. Requests and responses are JSON (application/json) except for file upload/download, script downloads, SSE/WebSocket streams and the XML/HTML SSO metadata/ACS endpoints.
• Errors. Failures return a JSON body of the form {"error": "<message>"} with the usual status codes: 400 bad input, 401 unauthenticated, 403 insufficient role, 404 not found, 500 internal error.
• Pagination. List endpoints paginate with limit/offset query parameters (typical defaults 50–100). GET /api/workspace/sessions/<session_id>/messages instead uses composite-key keyset pagination.
• Realtime. SSE and WebSocket endpoints are flagged inline in the Description column (e.g. the alert stream, autonomous workflow event stream, remote session stream, and the terminal/VS Code/agent WebSocket routes).
• Row granularity. One row per registered route; a few multi-method aliases share a row, so the row count can differ from a method-level count.
• Paths. Paths are written as registered. Most have no trailing slash; a few catch-all proxy routes keep a trailing-slash base form (Flask's strict-slashes behavior).

Endpoint families

Family	Prefix	Endpoints
Remote machines and sessions	/api/remote	56
Workspace	/api/workspace	46
Autonomous development	/api/autonomous	25
Single sign-on	/api/sso	20
Integration and notification management	/api/management	18
User and organization administration	/api/admin	18
Tenants	/api/tenants	19
Compliance	/api/compliance	17
Tool accounts	/api/tool-accounts	14
Analysis	/api/analysis	16
Alerts	/api/alerts	14
Projects	/api/projects	12
Quota	/api/quota	9
Mapping rules	/api/mapping-rules	8
Local file system	/api/fs	8
Encryption keys	/api/api/encryption-keys	8
Return on investment	/api/roi	7
Request statistics	/api/request	6
Authentication and account	/api/auth	6
External identity integration	/api/integrations/external	2
Other endpoints	—	87
Operational endpoints	—	10
Total		426

Remote machines and sessions (/api/remote)

Register and manage remote machines, drive remote AI sessions, web terminals and VS Code (code-server) instances, and speak the remote-agent protocol (registration, messaging, LLM proxy, usage reporting).

Method	Path	Auth	Description
GET	/api/remote/agent/files/<path:filename>	-	Serve agent source files for download during installation.
GET	/api/remote/agent/install.ps1	-	Serve the agent installation PowerShell script (Windows).
GET	/api/remote/agent/install.sh	-	Serve the agent installation shell script (Linux/macOS).
POST	/api/remote/agent/message	-	HTTP fallback for agent communication when WebSocket is not available.
POST	/api/remote/agent/register	-	Register a remote agent using a registration token.
GET	/api/remote/agent/uninstall.ps1	-	Serve the agent uninstallation PowerShell script (Windows).
GET	/api/remote/agent/uninstall.sh	-	Serve the agent uninstallation shell script (Linux/macOS).
GET	/api/remote/agent/ws	-	Deprecated WebSocket channel for agent communication (WebSocket); use HTTP polling via /api/remote/agent/message instead.
GET	/api/remote/heartbeat-status	admin_required	Get heartbeat monitor status for diagnostics.
POST/HEAD	/api/remote/llm-proxy	-	Transparent LLM API proxy for remote workspaces (empty path); forwards provider requests using stored encrypted API keys.
GET/POST/PUT/DELETE/HEAD	/api/remote/llm-proxy/<path:path>	-	Transparent LLM API proxy — catch-all path form.
GET	/api/remote/machines	-	List machines with tenant isolation.
DELETE	/api/remote/machines/<machine_id>	admin_required	Deregister a remote machine. Admin only.
GET	/api/remote/machines/<machine_id>	machine_access_required	Get details and status of a specific machine.
POST	/api/remote/machines/<machine_id>/assign	machine_admin_required	Assign a user to a machine. System admin or machine admin.
DELETE	/api/remote/machines/<machine_id>/assign/<int:user_id>	machine_admin_required	Revoke a user's access to a machine. System admin or machine admin.
GET	/api/remote/machines/<machine_id>/browse	machine_access_required	Browse the file system on a remote machine.
GET	/api/remote/machines/<machine_id>/commands	machine_access_required	Get operational commands for a specific machine.
POST	/api/remote/machines/<machine_id>/create-directory	-	Create a directory on a remote machine.
GET	/api/remote/machines/<machine_id>/git/diff	-	Get git diff for a specific file on a remote machine.
GET	/api/remote/machines/<machine_id>/git/file	-	Read a file from a remote machine.
GET	/api/remote/machines/<machine_id>/git/status	-	Get git status on a remote machine.
GET	/api/remote/machines/<machine_id>/sessions	machine_admin_required	Get list of active sessions on a machine. System admin or machine admin.
POST	/api/remote/machines/<machine_id>/token/revoke	admin_required	Revoke all agent tokens for a machine. System admin only.
POST	/api/remote/machines/<machine_id>/token/rotate	admin_required	Rotate the agent token for a machine. System admin only.
GET	/api/remote/machines/<machine_id>/users	machine_admin_required	Get list of users assigned to a machine. System admin or machine admin.
GET	/api/remote/machines/available	-	Get machines available to the current user.
POST	/api/remote/machines/register	admin_required	Generate a registration token for a new machine.
POST	/api/remote/sessions	machine_access_required	Create a new remote session on a selected machine.
GET	/api/remote/sessions/<session_id>	-	Get remote session status and output.
POST	/api/remote/sessions/<session_id>/abort	-	Abort the current in-progress request without stopping the session.
GET	/api/remote/sessions/<session_id>/approvals	-	Return the durable approval records for a remote session.
POST	/api/remote/sessions/<session_id>/chat	-	Send a message to a remote session.
GET	/api/remote/sessions/<session_id>/events	-	Return the persisted run timeline for a remote session.
POST	/api/remote/sessions/<session_id>/interaction	-	Send an interaction response from the frontend to the remote agent.
PUT	/api/remote/sessions/<session_id>/model	-	Switch the model of an active remote session.
POST	/api/remote/sessions/<session_id>/pause	-	Pause a remote session.
POST	/api/remote/sessions/<session_id>/permission	-	Send a permission response (approve/deny) from the frontend to the remote agent.
POST	/api/remote/sessions/<session_id>/resume	-	Resume a paused remote session.
POST	/api/remote/sessions/<session_id>/stop	-	Stop a remote session.
GET	/api/remote/sessions/<session_id>/stream	-	SSE: real-time stream of remote session output, formatted as claude_json.
POST	/api/remote/terminal/<terminal_id>/attach	-	Attach to existing terminal session (after browser refresh).
GET	/api/remote/terminal/<terminal_id>/status	-	Get terminal status.
GET	/api/remote/terminal/<terminal_id>/ws	-	Fallback for non-WebSocket requests to the terminal WebSocket endpoint (WebSocket).
POST	/api/remote/terminal/cli/start	machine_access_required	Start an SSH/local CLI-backed terminal session.
POST	/api/remote/terminal/start	machine_access_required	Start a web terminal on a remote machine.
POST	/api/remote/terminal/stop	machine_access_required	Stop a web terminal on a remote machine.
POST	/api/remote/token_info	-	Get token version information for an agent.
POST	/api/remote/usage-report	-	Receive an authenticated, bound, idempotent Agent usage report.
POST	/api/remote/vscode/<vscode_id>/attach	-	Re-attach to an existing code-server instance.
GET	/api/remote/vscode/<vscode_id>/status	-	Get the status of a code-server instance.
GET	/api/remote/vscode/<vscode_id>/ws	-	Fallback for non-WebSocket requests to the VS Code WebSocket endpoint (WebSocket).
GET/POST/PUT/DELETE/PATCH/OPTIONS/HEAD	/api/remote/vscode/<vscode_id>/proxy/<path:path>	-	HTTP reverse proxy to the remote code-server.
GET/POST/PUT/DELETE/PATCH/OPTIONS/HEAD	/api/remote/vscode/<vscode_id>/proxy/	-	Proxy base path (path empty).
POST	/api/remote/vscode/start	machine_access_required	Start a code-server instance on a remote machine.
POST	/api/remote/vscode/stop	machine_access_required	Stop a code-server instance on a remote machine.

Workspace (/api/workspace)

The built-in multi-user AI workspace: agent sessions, prompt templates, knowledge base, shares and annotations, teams, webui instances and the local LLM proxy.

Method	Path	Auth	Description
GET	/api/workspace/annotations	-	Get annotations for a session.
POST	/api/workspace/annotations	-	Create an annotation.
GET	/api/workspace/config	-	Get workspace configuration.
GET	/api/workspace/instances	-	List all active webui instances (admin only).
POST	/api/workspace/instances/<int:user_id>/stop	-	Stop a specific user's webui instance (admin only).
POST	/api/workspace/instances/stop-all	-	Stop all webui instances (admin only).
GET	/api/workspace/isolation-capabilities	auth_required	Get the workspace isolation capability contract.
GET	/api/workspace/knowledge	-	List knowledge base entries.
POST	/api/workspace/knowledge	-	Create a knowledge base entry.
GET	/api/workspace/knowledge/<entry_id>	-	Fetch one knowledge base entry (ownership-checked).
POST/HEAD	/api/workspace/llm-proxy	-	Transparent LLM proxy for local multi-user qwen-code-webui sessions (empty path).
GET/POST/PUT/DELETE/HEAD	/api/workspace/llm-proxy/<path:path>	-	Local LLM proxy — catch-all path form.
GET	/api/workspace/prompts	-	List prompt templates.
POST	/api/workspace/prompts	-	Create a new prompt template.
DELETE	/api/workspace/prompts/<int:template_id>	-	Delete a prompt template.
GET	/api/workspace/prompts/<int:template_id>	-	Get a prompt template.
PUT	/api/workspace/prompts/<int:template_id>	-	Update a prompt template.
POST	/api/workspace/prompts/<int:template_id>/copy	-	Record a prompt copy action (increments use count).
POST	/api/workspace/prompts/<int:template_id>/render	-	Render a prompt template with variables.
GET	/api/workspace/prompts/categories	-	Get prompt categories with counts.
GET	/api/workspace/prompts/featured	-	Get featured prompt templates.
GET	/api/workspace/remote-projects	-	Get user's remote workspace projects list.
GET	/api/workspace/session-models	-	Return integrated-mode qwen-code model options for the current scope context.
GET	/api/workspace/sessions	-	List agent sessions.
POST	/api/workspace/sessions	-	Create a new agent session.
DELETE	/api/workspace/sessions/<session_id>	-	Delete a session.
GET	/api/workspace/sessions/<session_id>	-	Get a session by ID.
POST	/api/workspace/sessions/<session_id>/complete	-	Mark a session as completed.
GET	/api/workspace/sessions/<session_id>/messages	-	Page through a session's messages with composite-key keyset pagination.
POST	/api/workspace/sessions/<session_id>/rename	-	Rename a session.
POST	/api/workspace/sessions/<session_id>/restore	-	Restore a historical session from agent_sessions to workspace.
GET	/api/workspace/sessions/stats	-	Get session statistics.
GET	/api/workspace/shares	-	List sessions shared with user.
POST	/api/workspace/shares	-	Share a session.
DELETE	/api/workspace/shares/<share_id>	-	Revoke a share.
GET	/api/workspace/status	-	Get workspace status including today's token and request usage for current user.
GET	/api/workspace/sync/events	-	Get sync events.
GET	/api/workspace/sync/stats	-	Get sync statistics.
GET	/api/workspace/teams	-	List user's teams.
POST	/api/workspace/teams	-	Create a new team.
GET	/api/workspace/terminal-models	-	Get all available models for terminal mode across all CLI tools.
GET	/api/workspace/tools	-	List available AI tools.
GET	/api/workspace/tools/<tool_name>	-	Get tool information.
GET	/api/workspace/tools/<tool_name>/models	-	Get available models for a tool.
GET	/api/workspace/tools/health	-	Check health of all tools.
GET	/api/workspace/user-url	-	Get the user-specific webui URL with authentication token.

Autonomous development (/api/autonomous)

Create and supervise autonomous development workflows: milestones, forks, retries, pause/resume, human verification overrides and a live event stream.

Method	Path	Auth	Description
DELETE	/api/autonomous/batches/<batch_id>	auth_required	Delete an entire batch of workflows.
POST	/api/autonomous/internal/events/ingest	public_endpoint	Cross-process SSE ingest: scheduler process → this web process.
GET	/api/autonomous/models	auth_required	Get available models for a given tool and workspace type.
GET	/api/autonomous/tools	auth_required	Get the list of available agent tools.
GET	/api/autonomous/workflows	auth_required	List autonomous development workflows.
POST	/api/autonomous/workflows	auth_required	Create a new autonomous development workflow.
DELETE	/api/autonomous/workflows/<workflow_id>	auth_required	Cancel and delete a workflow.
GET	/api/autonomous/workflows/<workflow_id>	auth_required	Get a workflow by ID.
POST	/api/autonomous/workflows/<workflow_id>/done	auth_required	Mark workflow as complete, triggering merge phase.
GET	/api/autonomous/workflows/<workflow_id>/events/stream	auth_required	SSE stream for real-time workflow events.
POST	/api/autonomous/workflows/<workflow_id>/extend-planning-timeout	auth_required	Extend the planning phase timeout for a timed-out workflow.
GET	/api/autonomous/workflows/<workflow_id>/forks	auth_required	List all child workflows forked from this one.
POST	/api/autonomous/workflows/<workflow_id>/milestones/<milestone_id>/cancel	auth_required	Cancel a milestone and all subsequent milestones with user feedback.
GET	/api/autonomous/workflows/<workflow_id>/milestones/<milestone_id>/diff	auth_required	Get the code diff for a milestone's commits.
POST	/api/autonomous/workflows/<workflow_id>/milestones/<milestone_id>/fork	auth_required	Fork from a milestone, creating a new independent workflow.
GET	/api/autonomous/workflows/<workflow_id>/milestones/<milestone_id>/session	auth_required	Get the agent session associated with a milestone.
POST	/api/autonomous/workflows/<workflow_id>/pause	auth_required	Pause a running workflow.
GET	/api/autonomous/workflows/<workflow_id>/pr-diff	auth_required	Get the cumulative PR diff (head vs base) for a workflow.
GET	/api/autonomous/workflows/<workflow_id>/pr-stats	auth_required	Get lightweight cumulative PR stats for a workflow.
POST	/api/autonomous/workflows/<workflow_id>/resume	auth_required	Resume a paused workflow.
POST	/api/autonomous/workflows/<workflow_id>/resume-with-feedback	auth_required	Resume a waiting workflow with updated user feedback.
POST	/api/autonomous/workflows/<workflow_id>/retry	auth_required	Retry a failed workflow from its current phase.
POST	/api/autonomous/workflows/<workflow_id>/stop	auth_required	Gracefully stop a workflow.
GET	/api/autonomous/workflows/<workflow_id>/timeline	auth_required	Get all milestones for a workflow (timeline).
POST	/api/autonomous/workflows/<workflow_id>/verification_override	auth_required	Human override: confirm an acceptance-paused workflow (#2335 S6, #2658).

Single sign-on (/api/sso)

SSO provider registry (OAuth2/OIDC/SAML), login flows, SAML metadata/ACS/SLO endpoints, session info and identity linking.

Method	Path	Auth	Description
POST	/api/sso/acs/<provider_name>	public_endpoint	Handle SAML HTTP-POST Assertion Consumer Service callbacks.
GET	/api/sso/callback/<provider_name>	public_endpoint	Handle SSO callback.
GET	/api/sso/identities/<int:user_id>	auth_required	Get SSO identities for a user.
DELETE	/api/sso/identities/<int:user_id>/<provider_name>	auth_required	Unlink an SSO identity from a user.
GET	/api/sso/login/<provider_name>	public_endpoint	Start SSO login flow.
GET	/api/sso/providers	public_endpoint	List available SSO providers.
POST	/api/sso/providers	admin_required	Register a new SSO provider (admin only).
DELETE	/api/sso/providers/<provider_name>	admin_required	Disable an SSO provider (DELETE method, deprecated - use PATCH /disable instead).
GET	/api/sso/providers/<provider_name>	admin_required	Get detailed information about a specific SSO provider.
PUT	/api/sso/providers/<provider_name>	admin_required	Update an existing SSO provider configuration.
PATCH	/api/sso/providers/<provider_name>/disable	admin_required	Disable an SSO provider (PATCH method, recommended).
PATCH	/api/sso/providers/<provider_name>/enable	admin_required	Enable an SSO provider.
GET	/api/sso/providers/<provider_name>/metadata	public_endpoint	Return SAML Service Provider metadata for an enabled SAML provider.
POST	/api/sso/providers/<provider_name>/reset	admin_required	Reset a predefined provider to its default configuration.
POST	/api/sso/providers/<provider_name>/test	admin_required	Test SSO provider connection (basic validation).
GET	/api/sso/providers/export	admin_required	Export SSO provider configurations.
DELETE	/api/sso/session	public_endpoint	Logout from SSO session.
GET	/api/sso/session	-	Get current SSO session info.
GET	/api/sso/slo-redirect/<provider_name>	public_endpoint	Handle SAML HTTP-Redirect Single Logout Service.
POST	/api/sso/slo/<provider_name>	public_endpoint	Handle SAML HTTP-POST Single Logout Service.

Integration and notification management (/api/management)

Administrative configuration for outbound integrations: Feishu, DingTalk, SMTP, generic webhook, model gateway and notification channel status.

Method	Path	Auth	Description
GET/PUT/DELETE	/api/management/dingtalk-config	-	Get, update, or delete the DingTalk integration configuration.
POST	/api/management/dingtalk-config/test	-	Test DingTalk credentials and organisation-sync permissions.
DELETE	/api/management/feishu-config	-	Delete Feishu configuration.
GET	/api/management/feishu-config	-	Get Feishu configuration.
PUT	/api/management/feishu-config	-	Update Feishu configuration.
POST	/api/management/feishu-config/test	-	Test Feishu connection and persist verification status.
DELETE	/api/management/model-gateway-config	-	Delete the model gateway configuration.
GET	/api/management/model-gateway-config	-	Get the model gateway configuration (API key masked) with enabled status.
PUT	/api/management/model-gateway-config	-	Save (replace) the model gateway configuration.
POST	/api/management/model-gateway-config/test	-	Test the gateway connection with supplied (or stored) credentials.
GET	/api/management/notification-channels/status	-	Get the aggregated configuration status of all notification channels.
DELETE	/api/management/smtp-config	-	Delete SMTP configuration.
GET	/api/management/smtp-config	-	Get SMTP configuration.
PUT	/api/management/smtp-config	-	Update SMTP configuration.
POST	/api/management/smtp-config/send-test	-	Send a test email notification.
GET	/api/management/smtp-config/statistics	-	Get email sending statistics.
POST	/api/management/smtp-config/test	-	Test SMTP connection.
GET/PUT/DELETE	/api/management/webhook-config	-	Get, update, or delete the generic webhook configuration (secret, private-URL policy, enabled flag).

User and organization administration (/api/admin)

Platform administration: user lifecycle and quotas, Feishu/DingTalk organization sync and tenant quota tooling.

Method	Path	Auth	Description
POST	/api/admin/dingtalk/sync	admin_required	Manually trigger a DingTalk organization sync.
GET	/api/admin/dingtalk/sync/lock-state	admin_required	Inspect the DingTalk org-sync advisory lock (holder pid + hold time).
POST	/api/admin/dingtalk/sync/release-lock	admin_required	Forcefully release a stuck DingTalk org-sync advisory lock.
POST	/api/admin/feishu/sync	admin_required	Manually trigger a Feishu organization sync.
GET	/api/admin/feishu/sync/lock-state	admin_required	Inspect the Feishu org-sync advisory lock (holder pid + hold time).
POST	/api/admin/feishu/sync/release-lock	admin_required	Forcefully release a stuck Feishu org-sync advisory lock.
POST	/api/admin/quota/health-check	admin_required	Check tenant quota health status.
GET	/api/admin/quota/stats	admin_required	Get quota allocation statistics for reference.
GET	/api/admin/quota/usage	admin_required	Get quota usage for all users the caller may see.
POST	/api/admin/quota/validate-allocation	admin_required	Validate if a quota allocation would exceed tenant limits.
GET	/api/admin/users	admin_required	Get all users, optionally filtered by tenant.
POST	/api/admin/users	admin_required	Create a new user.
DELETE	/api/admin/users/<int:user_id>	admin_required,same_tenant_user_required	Delete a user.
PUT	/api/admin/users/<int:user_id>	admin_required,same_tenant_user_required	Update a user.
PUT	/api/admin/users/<int:user_id>/password	admin_required,same_tenant_user_required	Update a user's password.
PUT	/api/admin/users/<int:user_id>/quota	admin_required,same_tenant_user_required	Update a user's quota.
POST	/api/admin/users/<int:user_id>/reset-password	admin_required,same_tenant_user_required	Reset user password and generate a temporary password.
POST	/api/admin/users/<int:user_id>/restore	admin_required,same_tenant_user_required	Restore a soft-deleted user.

Tenants (/api/tenants)

Multi-tenant lifecycle and settings: create/update/suspend tenants, quotas, billing periods, usage, stats and tenant sensitive keywords.

Method	Path	Auth	Description
GET	/api/tenants	platform_admin_required	List all tenants (platform admin only).
POST	/api/tenants	platform_admin_required	Create a new tenant (platform admin only). Optionally create an admin user.
DELETE	/api/tenants/<int:tenant_id>	platform_admin_required	Delete a tenant (platform admin only).
GET	/api/tenants/<int:tenant_id>	platform_admin_required	Get tenant by ID (platform admin only).
PUT	/api/tenants/<int:tenant_id>	platform_admin_required	Update tenant (platform admin only).
POST	/api/tenants/<int:tenant_id>/activate	platform_admin_required	Activate a suspended tenant (platform admin only).
POST	/api/tenants/<int:tenant_id>/check-quota	same_tenant_or_platform_admin	Check if tenant has quota available (same tenant or platform admin).
PUT	/api/tenants/<int:tenant_id>/quota	platform_admin_required	Update tenant quota (platform admin only).
POST	/api/tenants/<int:tenant_id>/reset-period	platform_admin_required	Reset billing period for a tenant (platform admin only).
GET	/api/tenants/<int:tenant_id>/sensitive-keywords	same_tenant_or_platform_admin	Get tenant sensitive keywords with pagination.
POST	/api/tenants/<int:tenant_id>/sensitive-keywords	same_tenant_or_platform_admin	Create a tenant sensitive keyword.
PUT	/api/tenants/<int:tenant_id>/sensitive-keywords/<int:keyword_id>	same_tenant_or_platform_admin	Update one tenant sensitive keyword.
DELETE	/api/tenants/<int:tenant_id>/sensitive-keywords/<int:keyword_id>	same_tenant_or_platform_admin	Delete one tenant sensitive keyword.
PUT	/api/tenants/<int:tenant_id>/settings	same_tenant_or_platform_admin	Update tenant settings (same tenant or platform admin).
GET	/api/tenants/<int:tenant_id>/stats	same_tenant_or_platform_admin	Get tenant statistics (same tenant or platform admin).
POST	/api/tenants/<int:tenant_id>/suspend	platform_admin_required	Suspend a tenant (platform admin only).
GET	/api/tenants/<int:tenant_id>/usage	same_tenant_or_platform_admin	Get tenant usage history (same tenant or platform admin).
GET	/api/tenants/plans	auth_required	Get quota configurations for all plans (authenticated users).
GET	/api/tenants/slug/<slug>	platform_admin_required	Get tenant by slug (platform admin only).

Compliance (/api/compliance)

Compliance reporting, audit analytics (patterns, anomalies, security score) and data-retention rules, status and cleanup.

Method	Path	Auth	Description
GET	/api/compliance/audit/anomalies	admin_required	Detect audit anomalies (admin only).
POST	/api/compliance/audit/anomalies/status	admin_required	Update anomaly status (admin only).
GET	/api/compliance/audit/patterns	admin_required	Analyze audit patterns (admin only).
GET	/api/compliance/audit/security-score	admin_required	Get security score (admin only).
GET	/api/compliance/audit/thresholds	admin_required	Get audit anomaly detection thresholds (admin only).
PUT	/api/compliance/audit/thresholds	admin_required	Update audit anomaly detection thresholds (admin only).
GET	/api/compliance/audit/user/<int:user_id>/profile	admin_required,same_tenant_user_required	Get user behavior profile (admin only).
GET	/api/compliance/reports	admin_required	List available report types.
POST	/api/compliance/reports	admin_required	Generate a compliance report (admin only).
GET	/api/compliance/reports/<report_id>	admin_required	Get a saved report (admin only).
GET	/api/compliance/reports/saved	admin_required	List saved reports the caller may see.
POST	/api/compliance/retention/cleanup	admin_required	Run data retention cleanup (admin only).
GET	/api/compliance/retention/history	admin_required	Get retention cleanup history (admin only).
GET	/api/compliance/retention/rules	admin_required	Get data retention rules (admin only).
PUT	/api/compliance/retention/rules	admin_required	Set a data retention rule (admin only).
GET	/api/compliance/retention/status	admin_required	Get data retention compliance status (admin only).
GET	/api/compliance/retention/storage	admin_required	Estimate storage usage (admin only).

Tool accounts (/api/tool-accounts)

Mappings between tool sender accounts and platform users, including pending, conflicting, stale and unmapped states.

Method	Path	Auth	Description
GET	/api/tool-accounts	-	Get all tool account mappings.
POST	/api/tool-accounts	-	Create a new tool account mapping.
DELETE	/api/tool-accounts/<int:id>	-	Delete a tool account mapping.
PUT	/api/tool-accounts/<int:id>	-	Update a tool account mapping.
POST	/api/tool-accounts/<int:id>/resolve-conflict	-	Resolve a conflict mapping.
POST	/api/tool-accounts/<int:id>/touch-activity	-	Update last_activity_at timestamp.
POST	/api/tool-accounts/<int:id>/verify	-	Verify a single tool account mapping.
GET	/api/tool-accounts/conflicts	-	Get all unresolved conflict mappings.
GET	/api/tool-accounts/pending	-	Get all pending (predeclared) mappings.
GET	/api/tool-accounts/stale	-	Get all stale mappings.
GET	/api/tool-accounts/status-summary	-	Get summary counts by mapping status.
GET	/api/tool-accounts/unmapped	-	Get sender_names that are not mapped to any user.
GET	/api/tool-accounts/user/<int:user_id>	-	Get tool accounts for a specific user.
POST	/api/tool-accounts/user/<int:user_id>/batch	-	Batch create tool account mappings for a user.

Analysis (/api/analysis)

Dashboard analytics over collected usage: key metrics, hourly/peak patterns, rankings, segmentation, anomalies and recommendations.

Method	Path	Auth	Description
GET	/api/analytics/forecast	any_admin_required	Get usage forecast.
GET	/api/analysis/forecast	any_admin_required	Alias route for the usage forecast.
GET	/api/analysis/anomaly-detection	-	Get anomaly detection results.
GET	/api/analysis/anomaly-trend	-	Get anomaly trend over time.
GET	/api/analysis/batch	-	Get all analysis data in a single request for better performance.
GET	/api/analysis/conversation-stats	-	Get conversation statistics.
GET	/api/analysis/daily-hourly-usage	-	Get daily and hourly usage patterns.
GET	/api/analysis/data-range	-	Get the global data range (min and max dates) for the "All" quick-range.
GET	/api/analysis/hourly-usage	-	Get hourly usage breakdown.
GET	/api/analysis/key-metrics	-	Get key metrics for the dashboard.
GET	/api/analysis/peak-usage	-	Get peak usage periods.
GET	/api/analysis/recommendations	-	Get usage optimization recommendations.
GET	/api/analysis/tool-comparison	-	Get tool comparison data.
GET	/api/analysis/user-ranking	-	Get user ranking by token usage.
GET	/api/analysis/user-role-distribution	-	Get user role distribution data.
GET	/api/analysis/user-segmentation	-	Get user segmentation data.

Alerts (/api/alerts)

The user-facing alert center: listing, read state, preferences, tenant alerts, failure queue and the SSE stream.

Method	Path	Auth	Description
GET	/api/alerts	-	Get alerts with filters.
DELETE	/api/alerts/<alert_id>	-	Delete an alert and sync to quota_alerts.
POST	/api/alerts/<alert_id>/read	-	Mark an alert as read and sync to quota_alerts.
GET	/api/alerts/consistency-check	-	Check consistency between quota_alerts and alerts tables.
GET	/api/alerts/failure-queue	-	Get alert creation failure queue status.
POST	/api/alerts/failure-queue/retry	-	Manually trigger processing of the failure queue.
GET	/api/alerts/preferences	-	Get notification preferences for current user.
PUT	/api/alerts/preferences	-	Update notification preferences for current user.
POST	/api/alerts/read-all	-	Mark all alerts as read.
GET	/api/alerts/stream	-	Server-Sent Events stream for real-time alerts.
POST	/api/alerts/sync-cleanup	-	Trigger synchronized cleanup of old alerts.
GET	/api/alerts/tenant	tenant_member_required	Get tenant-scoped alerts.
POST	/api/alerts/test	-	Create a test alert (for testing purposes).
GET	/api/alerts/unread-count	-	Get count of unread alerts.

Projects (/api/projects)

Shared projects: CRUD, daily statistics and collaborator management.

Method	Path	Auth	Description
GET	/api/projects	-	Get projects accessible by current user.
POST	/api/projects	-	Create a new project.
DELETE	/api/projects/<int:project_id>	-	Delete a project (soft delete).
GET	/api/projects/<int:project_id>	-	Get project details.
PUT	/api/projects/<int:project_id>	-	Update project information.
GET	/api/projects/<int:project_id>/daily	-	Get daily statistics for a project.
POST	/api/projects/<int:project_id>/fix-permissions	-	Fix shared project directory permissions.
GET	/api/projects/<int:project_id>/users	-	Get users collaborating on a project.
POST	/api/projects/<int:project_id>/users	-	Add a user to a shared project.
PUT	/api/projects/<int:project_id>/users	-	Batch update visible users for a shared project.
DELETE	/api/projects/<int:project_id>/users/<int:target_user_id>	-	Remove a user from a shared project.
GET	/api/projects/stats	-	Get statistics for all projects (admin only).

Quota (/api/quota)

Per-user and admin quota views and checks, quota alerts and the webui-token quota check.

Method	Path	Auth	Description
GET	/api/quota/alerts	admin_required	Get quota alerts.
POST	/api/quota/alerts/<int:alert_id>/acknowledge	admin_required	Acknowledge a quota alert.
GET	/api/quota/check	auth_required	Check if the current user has quota available.
POST	/api/quota/check	auth_required	Check if user has quota available.
POST	/api/quota/check-all	-	Manually trigger quota check for all users.
GET	/api/quota/status	auth_required	Get detailed quota status for the current user.
GET	/api/quota/status/all	admin_required	Get quota status for all users (admin only).
GET	/api/quota/usage/me	auth_required	Get detailed usage data for the current user.
GET	/api/quota/webui-check	public_endpoint	Check quota using webui token (called by webui backend middleware).

Mapping rules (/api/mapping-rules)

The rule engine that auto-maps tool accounts to users: rule CRUD, match testing and per-user default generation.

Method	Path	Auth	Description
GET	/api/mapping-rules	admin_required	Get all mapping rules.
POST	/api/mapping-rules	admin_required	Create a new mapping rule.
DELETE	/api/mapping-rules/<int:id>	admin_required	Delete a mapping rule.
PUT	/api/mapping-rules/<int:id>	admin_required	Update a mapping rule.
POST	/api/mapping-rules/auto-map	admin_required	Run auto-mapping for all unmapped accounts.
POST	/api/mapping-rules/test-match	admin_required	Test if a tool_account matches any rules.
GET	/api/mapping-rules/user/<int:user_id>	admin_required	Get mapping rules for a specific user.
POST	/api/mapping-rules/user/<int:user_id>/generate-default	admin_required	Generate default mapping rules for a user.

Local file system (/api/fs)

Bounded file access inside the user's home subtree: browse, search, upload, download and delete.

Method	Path	Auth	Description
GET	/api/fs/browse	-	Browse a directory and list subdirectories (and optionally files).
POST	/api/fs/check-path	-	Check if a path is valid and can be used for a project.
POST	/api/fs/create-directory	-	Create a directory on the local file system.
POST	/api/fs/delete-file	-	Delete a file from the user's home subtree.
GET	/api/fs/download	-	Stream a file from the user's home subtree as an attachment.
GET	/api/fs/home	-	Get user's home directory.
GET	/api/fs/search	-	Recursively search directory/file names under a home-subtree path.
POST	/api/fs/upload	-	Upload a file into the user's home subtree (personal files page).

Encryption keys (/api/api/encryption-keys)

Database encryption key management: rotation, validation, re-encryption, multi-replica sync status and the audit log.

Method	Path	Auth	Description
GET	/api/api/encryption-keys	platform_admin_required	Get metadata for all encryption keys.
GET	/api/api/encryption-keys/audit-log	platform_admin_required	Query the key-operation audit log.
POST	/api/api/encryption-keys/generate-env-config	platform_admin_required	Generate environment-variable configuration for external systems.
POST	/api/api/encryption-keys/re-encrypt	platform_admin_required	Re-encrypt all existing ciphertext with the current key.
POST	/api/api/encryption-keys/re-encrypt/pre-check	platform_admin_required	Pre-check existing ciphertext formats before a re-encryption run.
POST	/api/api/encryption-keys/rotate	platform_admin_required	Rotate the encryption key.
GET	/api/api/encryption-keys/sync-status	platform_admin_required	Get multi-replica key synchronization status.
POST	/api/api/encryption-keys/validate	platform_admin_required	Validate key format.

Return on investment (/api/roi)

ROI views built on configurable planning assumptions: totals, trends, per-tool/per-user breakdowns and cost detail.

Method	Path	Auth	Description
GET	/api/roi	-	Get ROI metrics for a period.
GET	/api/roi/by-tool	-	Get ROI breakdown by tool.
GET	/api/roi/by-user	-	Get ROI breakdown by user.
GET	/api/roi/cost-breakdown	-	Get detailed cost breakdown.
GET	/api/roi/daily-costs	-	Get daily cost data for charting.
GET	/api/roi/summary	-	Get ROI summary statistics.
GET	/api/roi/trend	-	Get ROI trend over months.

Request statistics (/api/request)

AI request counts (assistant responses): today, trend, per-tool, per-user and monthly aggregates.

Method	Path	Auth	Description
GET	/api/request/by-tool	-	Get request trend data aggregated by date and tool for charts.
GET	/api/request/by-user	-	Get request statistics grouped by user (sender_name) for today.
GET	/api/request/monthly	-	Get monthly request statistics grouped by user.
GET	/api/request/today	-	Get today's request statistics with total and by-tool breakdown.
GET	/api/request/trend	-	Get request trend data aggregated by date for charts.
GET	/api/request/user/<user_name>/trend	-	Get request trend data for a specific user.

Authentication and account (/api/auth)

Session login/logout, password change and current-user profile.

Method	Path	Auth	Description
POST	/api/auth/change-password	auth_required	Change password endpoint.
GET	/api/auth/check	-	Check if user is authenticated and extend session if needed.
POST	/api/auth/login	-	Login endpoint.
POST	/api/auth/logout	public_endpoint	Logout endpoint.
GET	/api/auth/me	auth_required	Get current user info (alias for /auth/profile).
GET	/api/auth/profile	auth_required	Get current user profile.

External identity integration (/api/integrations/external)

Default-off bridge for trusted external identity issuers. Both endpoints authenticate each request by its HMAC-SHA256 signature (X-ACE-Issuer/X-ACE-Time/X-ACE-Nonce/X-ACE-Signature headers, database-backed replay protection) — no cookie, bearer token, browser origin or query identity is ever accepted, hence the - Auth column. The policy file (OPENACE_EXTERNAL_IDENTITY_POLICY_FILE) gates the whole family: without it both endpoints return 404.

Method	Path	Auth	Description
POST	/api/integrations/external/capabilities	-	Read-only probe: verifies the signed request and reports the mapped issuer identity plus whether the token exchange is available (providers and models configured and OPENACE_EXTERNAL_TOKEN_ENABLED=1); consumes nothing.
POST	/api/integrations/external/token	-	Exchange a signed request for a short-lived scoped proxy token for the mapped user (openace-external-v1); idempotent per external identity, audited, returns the token, expiry and the fixed LLM proxy path. Returns 404 unless the policy file and OPENACE_EXTERNAL_TOKEN_ENABLED=1 are set.

Other endpoints

Smaller families without a dedicated section: analytics and insights, audit trails, content governance and policy, data fetch/upload pipelines, project categories, permission tasks, settings and schedulers, unmapped accounts, usage dashboards, API keys, user avatars and branding.

Method	Path	Auth	Description
GET	/api/ai-agent/settings	admin_required	Get AI agent settings (token masked).
PUT	/api/ai-agent/settings	admin_required	Update AI agent settings.
POST	/api/ai-agent/settings/validate-github-token	admin_required	Validate a GitHub PAT by calling the GitHub API.
GET	/api/analytics/efficiency	any_admin_required	Get efficiency metrics.
GET	/api/analytics/export	any_admin_required	Export analytics data.
GET	/api/analytics/report	any_admin_required	Generate a comprehensive usage report.
GET	/api/api-keys	api_key_admin_required	List all encrypted API keys (without revealing actual keys). Admin only.
POST	/api/api-keys	api_key_admin_required	Store a new encrypted API key. Admin only.
DELETE	/api/api-keys/<int:key_id>	api_key_admin_required	Delete an API key by ID. Admin only.
PUT	/api/api-keys/<int:key_id>	api_key_admin_required	Update an API key by ID. Admin only.
GET	/api/audit-actions	admin_required	Get all audit action types with categories.
GET	/api/audit-logs	admin_required	Get audit logs with filters (alias for /audit/logs).
GET	/api/audit/logs	admin_required	Get audit logs with filters.
GET	/api/audit/logs/export	admin_required	Export audit logs.
GET	/api/audit/user/<int:user_id>/activity	admin_required,same_tenant_user_required	Get activity summary for a user.
POST	/api/content/check	auth_required	Check content for sensitive information.
POST	/api/content/filter/keywords	platform_admin_required	Add a custom sensitive keyword.
POST	/api/content/filter/patterns	platform_admin_required	Add a custom content filter pattern.
GET	/api/content/filter/stats	admin_required	Get content filter statistics.
GET	/api/conversation-details/<path:session_id>	-	Get details of a conversation.
GET	/api/conversation-history	-	Get conversation history.
GET	/api/conversation-timeline/<path:session_id>	-	Get timeline of messages for a conversation.
GET	/api/data-status	auth_required	Get data status information.
GET	/api/date/<date_str>	-	Get usage for a specific date.
GET	/api/feature-flags	auth_required	Get current state of all feature flags.
GET	/api/fetch	admin_required	Fetch data from local sources.
POST	/api/fetch/data	auth_required	Trigger data collection from all sources.
GET	/api/fetch/remote	admin_required	Fetch data from remote sources.
GET	/api/fetch/status	auth_required	Get data fetch status.
GET	/api/filter-rules	admin_required	Get content filter rules with pagination and filtering.
POST	/api/filter-rules	platform_admin_required	Create a new content filter rule (idempotent).
DELETE	/api/filter-rules/<int:rule_id>	platform_admin_required	Delete a content filter rule.
PUT	/api/filter-rules/<int:rule_id>	platform_admin_required	Update a content filter rule.
POST	/api/frontend-errors	public_endpoint	Receive frontend error reports (public endpoint, no auth required).
GET	/api/governance/audit-logs	admin_required	Get audit logs with filters (full path alias for /audit/logs).
GET	/api/hosts	-	Get list of all hosts from pre-aggregated summary table and remote machines.
DELETE	/api/insights/<int:report_id>	auth_required	Delete an insights report.
POST	/api/insights/generate	auth_required	Generate or retrieve a cached insights report.
GET	/api/insights/history	auth_required	Get user's insights report history.
GET	/api/mapping-stats	admin_required	Get mapping statistics.
GET	/api/messages	-	Get messages with pagination and filters.
GET	/api/messages/count	-	Get count of messages with filters.
POST	/api/migrate-quota-alerts	-	Migrate quota_alerts to alerts table.
GET	/api/migration-progress	-	Get progress of quota_alerts to alerts migration.
GET	/api/optimization/cost-trend	-	Get cost trend for optimization analysis.
GET	/api/optimization/efficiency	-	Get efficiency analysis report.
GET	/api/optimization/suggestions	-	Get cost optimization suggestions.
GET	/api/password-policy	auth_required	Get password policy settings.
DELETE	/api/permission-tasks/<task_id>	-	Cancel a permission task.
GET	/api/permission-tasks/<task_id>	-	Get permission task status.
GET	/api/policy/decisions	admin_required	List policy decisions, filtered by session_id (and optionally request_id).
GET	/api/policy/rules	admin_required	List current (latest version) policy rules.
POST	/api/policy/rules	admin_required	Create a new policy rule (first version of a rule_key).
PATCH	/api/policy/rules/<int:rule_id>/enabled	admin_required	Toggle enabled on the current version of a rule.
PUT	/api/policy/rules/<rule_key>	admin_required	Versioned edit: supersede the current version and insert a new one.
GET	/api/project-categories	-	List all project categories.
POST	/api/project-categories	-	Create a new category (admin only).
DELETE	/api/project-categories/<int:category_id>	-	Delete a category (admin only).
PUT	/api/project-categories/<int:category_id>	-	Update a category (admin only).
GET	/api/public/branding	-	Get branding configuration for login page.
GET	/api/range	-	Get usage for a date range.
GET	/api/report/my-usage	auth_required	Get current user's usage report.
GET	/api/schedulers	-	Get status of all background schedulers.
GET	/api/schedulers/data-fetch	-	Get data fetch scheduler status.
GET	/api/schedulers/quota-enforcement	-	Get quota enforcement scheduler status.
GET	/api/security-settings	admin_required	Get security settings.
PUT	/api/security-settings	platform_admin_required	Update security settings.
GET	/api/security-settings/upload-auth-status	admin_required	Get upload authentication status.
GET	/api/senders	-	Get list of all senders (cached for 5 minutes).
GET	/api/settings	-	Get all system settings.
PUT	/api/settings	-	Update system settings.
GET	/api/settings/sso-enabled	-	Get SSO enabled status.
GET	/api/summary	-	Get summary statistics for all tools from pre-aggregated summary table.
POST	/api/summary/refresh	-	Refresh summary data from daily_messages table.
GET	/api/today	-	Get today's usage for all tools, merged by tool_name.
GET	/api/tool-types	-	Get available tool types.
GET	/api/tool/<tool_name>/<int:days>	-	Get usage for a specific tool over N days.
GET	/api/tools	-	Get list of all tools.
GET	/api/trend	-	Get usage trend data aggregated by date for charts.
GET	/api/unmapped-accounts	admin_required	Get list of unmapped tool accounts.
POST	/api/unmapped-accounts/<sender_name>/map	admin_required	Manually map an unmapped account to a user.
GET	/api/unmapped-accounts/<sender_name>/suggest-mapping	admin_required	Get suggested mapping for an unmapped account.
POST	/api/upload/batch	require_upload_auth	Upload batch data (usage and messages).
POST	/api/upload/messages	require_upload_auth	Upload message data.
POST	/api/upload/usage	require_upload_auth	Upload usage data.
DELETE	/api/user/avatar	auth_required	Delete user avatar.
POST	/api/user/avatar	auth_required	Upload user avatar.

Operational endpoints

Application-level health and readiness probes, Prometheus metrics, security baseline status, plus the React SPA page and static routes.

Method	Path	Auth	Description
GET	/	public_endpoint	Serve the React SPA for the main page.
GET	/<path:path>	public_endpoint	Serve React SPA for all other routes.
GET	/health	-	Health check endpoint for Docker and load balancers.
GET	/livez	-	Liveness probe for Kubernetes.
GET	/login	public_endpoint	Serve the React SPA for the login page.
GET	/logout	public_endpoint	Logout and serve React SPA.
GET	/metrics	-	Prometheus metrics (fallback endpoint when prometheus_flask_exporter is not available).
GET	/readyz	-	Readiness check endpoint for Kubernetes and load balancers.
GET	/security-status	-	Security baseline status endpoint for monitoring and health checks.
GET	/static/claude-code-webui/<path:filename>	public_endpoint	Serve static files.

Related documentation

• API_PERMISSION_MATRIX.md — generated permission matrix for every elevated endpoint (regenerate after changing decorators).
• ../guide/REMOTE_WORKSPACE.md — remote machines, sessions, terminals and VS Code workflows.
• ../guide/REMOTE_AGENT.md — agent installation and the agent protocol.
• AUTONOMOUS_DEVELOPMENT.md — autonomous workflow lifecycle and milestone model.
• MODEL_GATEWAY.md — model gateway configuration and the LLM proxy chain.
• TOKEN_ACCOUNTING.md — token and request accounting semantics behind the usage/quota endpoints.
• PERMISSION_MODEL.md — role model and tenant-admin scope.
• ../security/API_EXCEPTIONS.md — routes deliberately exempted from authentication.