HTTP Surface
Every route below is served by the same process as the WebSocket endpoints — see architecture for how the transports and this HTTP surface share one coordinator and storage layer.
- GET
/health— readiness probe — {"status":"ok"} - GET
/admin/*— shared Lustre admin SPA - GET
/auth/github— begin GitHub OAuth - GET
/auth/github/callback— complete GitHub OAuth - GET
/api/auth/config— UI auth capabilities - GET
/api/auth/me— current cookie/bearer admin - POST
/api/auth/logout— end the admin session - POST
/api/tenants/:tenant/token-mint— mint a document token (dev/integration) - GET
/api/tenants— list tenants (admin session or key) - POST
/api/tenants— create a tenant (admin session or key) - GET
/api/tenants/:id— show a tenant with its secrets (admin session or key) - DELETE
/api/tenants/:id— delete a tenant (admin session or key) - POST
/api/tenants/:id/secrets/:slot— regenerate secret slot 1 or 2 (admin session or key) - POST
/documents/:tenant— create a document (id from body, or generated) - POST
/documents/:tenant/:id— create a document with an explicit id - GET
/documents/:tenant/:id— document metadata - GET
/documents/:tenant/session/:id— session discovery - GET
/documents/:tenant/:id/deltas— ops catch-up - GET
/deltas/:tenant/:id— ops catch-up (Levee-style path) - GET
/repos/:tenant/commits— commit history - GET
/repos/:tenant/git/refs— list refs - POST
/repos/:tenant/git/refs— create a ref - GET
/repos/:tenant/git/refs/*path— read a ref - PATCH
/repos/:tenant/git/refs/*path— update a ref - POST
/repos/:tenant/git/{blobs,trees,commits}— create a git object - GET
/repos/:tenant/git/{blobs,trees,commits}/:sha— read a git object