/docs/api
Public API.
All endpoints are unauthenticated GET requests that return JSON, with CORS open. The OpenAPI document is at /openapi.json. Records include
dataMode.<?php$page = ["auth" => none (read-only),"cors" => *,"spec" => /openapi.json,"stream" => /api/v1/stream,];
GET /api/v1/statusComputed health of every service and capability flags. Alias: /status.jsonGET /api/v1/projectProject metadata, evidence URLs and operational capabilities. Alias: /project.jsonGET /api/v1/cvesTracked advisories and fixed-release table with data sourceGET /api/v1/cves/{id}Live lookup across NVD, GitHub Advisories and CISA KEV with provenanceGET /api/v1/patchesPatch records. REAL only unless the server runs DEMO_MODEGET /api/v1/patches/{id}Single patch recordGET /api/v1/public-checkRead-only inspection of one user-supplied public GitHub repositoryGET /api/v1/public-checksCompleted public repository inspections. Read-only findings, never patchesGET /api/v1/repos/{owner}/{repo}Repository authorization, patch history and metricsGET /api/v1/eventsAgent event log (limit ≤ 500)GET /api/v1/proofREAL-only verification ledger with external URLs and hashesGET /api/v1/tokenToken contract address (null until launched); changes stream as `config` eventsGET /api/v1/treasuryRead-only treasury balance and signaturesGET /api/v1/metricsMetrics computed from recorded timestampsGET /api/v1/sourcesCitation registryGET /api/v1/agentWorker telemetry: running, last run time and summary, scheduler and write flagsGET /api/v1/streamServer-Sent Events: event `agent` carries an AgentEventPOST /api/webhooks/githubGitHub App webhook. Requires a valid X-Hub-Signature-256.
Stream example
const es = new EventSource("/api/v1/stream");
es.addEventListener("agent", (m) => {
const e = JSON.parse(m.data); // AgentEvent
console.log(e.dataMode, e.eventType, e.message);
});