API reference
Every endpoint on the control plane. Authenticated routes use the session cookie set by the magic-link verify call.
Auth
POST /v1/auth/magic-link — body {"email":"…"} — emails (or prints in dev) a one-time link.
POST /v1/auth/verify — body {"token":"…"} — exchanges the token for a session cookie.
GET /v1/auth/me — returns the current session user + org.
POST /v1/auth/logout — destroys the session.
Servers
GET /v1/servers — list servers in the current org.
POST /v1/servers/preview — body {"prompt":"…"} — runs Claude synchronously, validates the spec, caches it, returns { previewId, source, spec }.
POST /v1/servers — body {name, slug, prompt, secrets, previewId?}— creates the server, queues the build, returns the server + build records.
GET /v1/servers/:id — server detail with the latest 10 build records.
POST /v1/servers/:id/iterate — body {prompt, secrets} — queues a new version build.
DELETE /v1/servers/:id — removes the server and tears down the container.
Builds
GET /v1/builds/:id — build record + persisted logs.
WS /v1/builds/:id/stream — live event stream of build events:status, log, done, error.
OAuth (clients of generated servers, not dashboard)
GET /.well-known/oauth-authorization-server/oauth — RFC 8414 metadata.
GET /oauth/jwks — RS256 public key for verifying access tokens.
POST /oauth/register — RFC 7591 dynamic client registration.
GET /oauth/authorize — authorization code endpoint, requires session.
POST /oauth/token — code exchange + refresh.
Curl example
# 1. magic link
curl -X POST http://localhost:4000/v1/auth/magic-link -d '{"email":"[email protected]"}'
# (grab token from API console)
# 2. verify -> session
curl -c cookies.txt -X POST http://localhost:4000/v1/auth/verify -d '{"token":"…"}'
# 3. preview
curl -b cookies.txt -X POST http://localhost:4000/v1/servers/preview \
-d '{"prompt":"echo server with one tool: echo(message)"}'
# 4. build
curl -b cookies.txt -X POST http://localhost:4000/v1/servers \
-d '{"name":"Echo","slug":"echo","prompt":"…","secrets":{},"previewId":"…"}'