The public HTTP API is served directly at http://localhost:8080 in development. Production Nginx exposes the same routes below /api.
Authentication model
Application routes use an encrypted session cookie. Mutating routes additionally validate CSRF state. The gateway exchanges browser identity for signed service metadata on internal gRPC calls.
Content type
Send Content-Type: application/json for JSON request bodies. SSE log streams use text/event-stream, and raw log downloads use text/plain.
Safe retries
The following commands require Idempotency-Key:
POST /workflowsPUT /workflows/{workflow_id}POST /workflows/{workflow_id}/jobs/schedule
Reuse a key only when retrying the same logical command.
Reference
The endpoint reference is generated from the repository's OpenAPI document. It covers paths, parameters, request bodies, and response status codes.
The production Nginx ingress applies per-client limits: login and registration allow 10 requests per minute (burst 5); other routes including /api/auth/logout, /api/auth/validate, and the server-sent events handshake allow 20 requests per second (burst 40). The events endpoint additionally allows up to 5 concurrent connections per client. Request bodies are capped at 4 MiB. Limits are enforced per ingress replica. Exceeding a rate or connection limit returns 429; oversized bodies return 413. Immutable build assets under /_next/static/ are exempt from request-rate limiting but are still connection-limited.