App session API
The AgentDB app in your browser uses these endpoints with its sign-in session. They are listed for completeness.
Agents and scripts should use the operations in the reference with an API key or OAuth instead. These endpoints follow the app and may change with it.
| Endpoint | Operation id | Summary |
|---|---|---|
GET /app/dashboard-access | app.dashboard_sites.access | The owner, an admin or the creator opens a custom dashboard or a preview (?preview=<version>) with a single-use code |
POST /v1/app/account-link/confirm | app.account_link.confirm | Use an emailed link: verify the address, set the password or change the address |
GET /v1/app/account-link/peek | app.account_link.peek | What an emailed account link does and the masked address (does not use the link) |
POST /v1/app/account/email | app.account.email | Change the email address; the new address confirms and the old address approves, both by link (x-csrf-token) |
GET /v1/app/account/key-review | app.account.key_review | Keys and connected apps created before the address was proven, waiting for keep or revoke |
POST /v1/app/account/key-review | app.account.key_review.decide | Keep or revoke keys and connected apps from before the address was proven (decisions, or revoke_all) (x-csrf-token) |
POST /v1/app/account/keys/{key}/revoke | app.account.keys.revoke | Revoke one account API key of the signed-in account (Origin + x-csrf-token + recent sign-in; second factor when 2FA is on) |
GET /v1/app/account/keys | app.account.keys.list | Live account API keys of the signed-in account: label, prefix (never the secret), created, last used, created via, reach (browser session only) |
POST /v1/app/account/keys | app.account.keys.create | Create an account API key, shown once (label required; second factor when 2FA is on) |
POST /v1/app/account/passkeys/options | app.account.passkeys.options | WebAuthn registration options for a new passkey (single-use challenge; needs the same proof as authenticator setup) |
POST /v1/app/account/passkeys/{passkey}/remove | app.account.passkeys.remove | Remove a passkey (needs a current second factor) |
POST /v1/app/account/passkeys/{passkey}/rename | app.account.passkeys.rename | Rename a passkey (needs a current second factor) |
POST /v1/app/account/passkeys | app.account.passkeys.add | Add a passkey; the first factor returns 10 recovery codes once |
POST /v1/app/account/password | app.account.password | Change the password (needs the current one) or set a first password (confirmed by email) (x-csrf-token) |
POST /v1/app/account/recovery-codes | app.account.recovery_codes | Replace the recovery codes; the new 10 are shown once (needs a current second factor) |
GET /v1/app/account/security | app.account.security | Second-factor status, passkeys and recovery codes left (no secrets) |
POST /v1/app/account/totp/disable | app.account.totp.disable | Remove the authenticator app (needs a current second factor) |
POST /v1/app/account/totp/enable | app.account.totp.enable | Turn the authenticator app on with one valid code; the first factor returns 10 recovery codes once |
POST /v1/app/account/totp/setup | app.account.totp.setup | Start authenticator-app setup: secret, otpauth URI and QR code (x-csrf-token, recent sign-in; a second factor, or the current password before the first one) |
POST /v1/app/account/two-step/email-confirm | app.account.two_step.email_confirm | Account without a password: email the link that confirms adding the first second factor |
POST /v1/app/account/verify-email | app.account.verify_email | Email the verification link again (x-csrf-token) |
POST /v1/app/connections/{client_id}/disconnect | app.connections.disconnect | Revoke every access token and refresh token of one OAuth client for this account; idempotent (Origin + x-csrf-token; browser session only) |
GET /v1/app/connections | app.connections.list | OAuth connections (MCP connectors) of the signed-in account, per client: name, redirect host, connected since, last used, reach, live tokens (browser session only) |
GET /v1/app/dashboards/{dashboard}/preview | app.dashboards.preview | A dashboard's data for its owner, for the hosted page opened without a token (owners and admins; browser session only) |
GET /v1/app/hub/channels | app.hub.channels | Channels you belong to in every workspace |
GET /v1/app/hub/inbox | app.hub.inbox | Your open inbox items in every workspace (mentions, assignments, approvals, reminders, reviews, failures) |
GET /v1/app/hub/reports | app.hub.reports | Saved views of type report in every workspace (render with views/:view/render) |
GET /v1/app/hub | app.hub | AgentHub: pending approvals, recent activity, schedules and failures, notifications across the account's workspaces |
POST /v1/app/login | app.login | Sign in with email and password; sets the browser session cookie (one generic error; throttled) |
GET /v1/app/me | app.me | Signed-in account, its workspaces and the CSRF token |
POST /v1/app/passkey/login | app.passkey.login | Passwordless sign-in with a passkey (user verification required); sets the session cookie |
POST /v1/app/passkey/options | app.passkey.options | WebAuthn options for passwordless sign-in with a passkey |
POST /v1/app/password/forgot | app.password.forgot | Email a 30-minute single-use password reset link (same answer for any address) |
POST /v1/app/password/reset | app.password.reset | Set a new password with the emailed reset link; ends every session of the account |
POST /v1/app/sign-in/complete | app.sign_in.complete | Trade the emailed token for a browser session cookie (ends this browser's previous session) |
GET /v1/app/sign-in/peek | app.sign_in.peek | Masked address a sign-in token is for (does not use the token) |
POST /v1/app/sign-in/second-factor | app.sign_in.second_factor | Second step of a sign-in: TOTP code, recovery code or passkey; sets the session cookie |
POST /v1/app/sign-in | app.sign_in | Email a 15-minute sign-in link for the explorer (same answer for any address) |
POST /v1/app/sign-out-all | app.sign_out_all | End every browser session of the account (x-csrf-token) |
POST /v1/app/sign-out | app.sign_out | End this browser session (x-csrf-token) |
POST /v1/app/sign-up | app.sign_up | Create an account with email and password (same answer for any address; a verification link is emailed) |
GET /v1/app/workspaces/{ws}/access | app.access | Your role and per-object / per-field access (as access_inspect) |
POST /v1/app/workspaces/{ws}/approvals/{approval}/decide | app.approvals.decide | Approve, reject or request changes (Origin + x-csrf-token, session younger than 12 h, approver role, action_hash of the reviewed action). The only way to decide a human-only proposal |
GET /v1/app/workspaces/{ws}/approvals/{approval} | app.approvals.get | One proposal with decisions and result |
GET /v1/app/workspaces/{ws}/approvals | app.approvals.list | Proposals (as approvals_list) |
DELETE /v1/app/workspaces/{ws}/attachments/{attachment} | app.files.detach | Detach a file from a record (Origin + x-csrf-token + Idempotency-Key, session younger than 12 h, member role) |
POST /v1/app/workspaces/{ws}/attachments | app.files.attach | Attach a file to a record (Origin + x-csrf-token + Idempotency-Key, session younger than 12 h, member role) |
GET /v1/app/workspaces/{ws}/channels/{channel}/messages | app.messages.list | Messages of a channel or thread (as messages_list) |
POST /v1/app/workspaces/{ws}/channels/{channel}/messages | app.messages.post | Post a message or a thread reply as yourself (Origin + x-csrf-token + Idempotency-Key, session younger than 12 h, member role) |
POST /v1/app/workspaces/{ws}/dashboard-sites/{site}/delete | app.dashboard_sites.delete | Delete a custom dashboard and its files (Origin + x-csrf-token + second factor) (owners and admins; browser session only) |
POST /v1/app/workspaces/{ws}/dashboard-sites/{site}/invite | app.dashboard_sites.invite | Invite viewers by email (Origin + x-csrf-token + second factor) (owners and admins; browser session only) |
POST /v1/app/workspaces/{ws}/dashboard-sites/{site}/keep | app.dashboard_sites.keep | Keep a dashboard as it is after its creator lost access (understand: true) (Origin + x-csrf-token + second factor) (owners and admins; browser session only) |
POST /v1/app/workspaces/{ws}/dashboard-sites/{site}/pause | app.dashboard_sites.pause | Pause a custom dashboard (neutral page, no data, sessions end) (Origin + x-csrf-token + second factor) (owners and admins; browser session only) |
POST /v1/app/workspaces/{ws}/dashboard-sites/{site}/regenerate-link | app.dashboard_sites.regenerate_link | Link mode: a new link; the old one stops at once (Origin + x-csrf-token + second factor) (owners and admins; browser session only) |
POST /v1/app/workspaces/{ws}/dashboard-sites/{site}/resume | app.dashboard_sites.resume | Resume a paused custom dashboard (Origin + x-csrf-token + second factor) (owners and admins; browser session only) |
POST /v1/app/workspaces/{ws}/dashboard-sites/{site}/revoke | app.dashboard_sites.revoke | Revoke a custom dashboard at once (Origin + x-csrf-token + second factor) (owners and admins; browser session only) |
GET /v1/app/workspaces/{ws}/dashboard-sites/{site}/share | app.dashboard_sites.share_get | Sharing of a custom dashboard: mode, URL, password set, viewers (owners and admins; browser session only) |
POST /v1/app/workspaces/{ws}/dashboard-sites/{site}/share | app.dashboard_sites.share_set | Change sharing: mode (link needs confirm_link), password, expiry (Origin + x-csrf-token + second factor) (owners and admins; browser session only) |
POST /v1/app/workspaces/{ws}/dashboard-sites/{site}/transfer/accept | app.dashboard_sites.transfer_accept | The receiving account accepts an offered ownership transfer; audited (D-099) (Origin + x-csrf-token + second factor) (owners and admins; browser session only) |
POST /v1/app/workspaces/{ws}/dashboard-sites/{site}/transfer | app.dashboard_sites.transfer | The owner offers the dashboard to another account of the workspace ({email}; null withdraws); audited (D-099) (Origin + x-csrf-token + second factor) (owners and admins; browser session only) |
POST /v1/app/workspaces/{ws}/dashboard-sites/{site}/unpublish | app.dashboard_sites.unpublish | Take a custom dashboard offline (Origin + x-csrf-token + second factor) (owners and admins; browser session only) |
POST /v1/app/workspaces/{ws}/dashboard-sites/{site}/viewers/{viewer}/revoke | app.dashboard_sites.revoke_viewer | Remove one viewer (Origin + x-csrf-token + second factor) (owners and admins; browser session only) |
GET /v1/app/workspaces/{ws}/dashboard-sites | app.dashboard_sites.list | Custom dashboards of the workspace: sharing mode, URL, status (owners and admins; browser session only) |
POST /v1/app/workspaces/{ws}/dashboards/{dashboard}/revoke | app.dashboards.revoke | Revoke a dashboard link at once (Origin + x-csrf-token) (owners and admins; browser session only) |
POST /v1/app/workspaces/{ws}/dashboards/{dashboard}/rotate | app.dashboards.rotate | New link for the same dashboard; the old link stops (Origin + x-csrf-token) (owners and admins; browser session only) |
GET /v1/app/workspaces/{ws}/dashboards | app.dashboards.list | Dashboards of the workspace with creator, expiry and access counts (owners and admins; browser session only) |
POST /v1/app/workspaces/{ws}/delete | app.workspace.delete | Schedule deletion from the explorer (Origin + x-csrf-token + Idempotency-Key, session younger than 12 h, owner) |
GET /v1/app/workspaces/{ws}/files/search | app.files.search | Search file names and extracted text (as files_search) |
GET /v1/app/workspaces/{ws}/files/{file}/content | app.files.content | File bytes (attachment; ?inline=1 for png/jpeg/gif/webp images and the audio/video types of signed links; Range supported) |
PATCH /v1/app/workspaces/{ws}/files/{file}/content | app.files.content | Upload one part of a file (Upload-Offset; resumable) (Origin + x-csrf-token + Idempotency-Key, session younger than 12 h, member role) |
GET /v1/app/workspaces/{ws}/files/{file}/thumbnail | app.files.thumbnail | Thumbnail JPEG made by the media worker (404 until one exists; worker off by default) |
GET /v1/app/workspaces/{ws}/files/{file}/upload | app.files.upload_status | Bytes received so far for a pending upload |
PATCH /v1/app/workspaces/{ws}/files/{file}/versions/{version}/content | app.files.version.content | Upload one part of a pending version (Upload-Offset; resumable) (Origin + x-csrf-token + Idempotency-Key, session younger than 12 h, member role) |
GET /v1/app/workspaces/{ws}/files/{file}/versions | app.files.versions | Version history of a file, newest first |
POST /v1/app/workspaces/{ws}/files/{file}/versions | app.files.version.create | Start a replacement version of a file (editors and up) (Origin + x-csrf-token + Idempotency-Key, session younger than 12 h, member role) |
GET /v1/app/workspaces/{ws}/files/{file} | app.files.get | One file with media metadata and text extraction status |
GET /v1/app/workspaces/{ws}/files | app.files.list | Files of the workspace (folder, recursive, tag, kind filters; as files_list) |
POST /v1/app/workspaces/{ws}/files | app.files.create | Start a file upload (pending file) (Origin + x-csrf-token + Idempotency-Key, session younger than 12 h, member role) |
PATCH /v1/app/workspaces/{ws}/inbox/{item} | app.inbox.update | Mark an inbox item unread, read or done (Origin + x-csrf-token + Idempotency-Key, session younger than 12 h, member role) |
GET /v1/app/workspaces/{ws}/inbox | app.inbox.list | Your inbox (as inbox_list) |
GET /v1/app/workspaces/{ws}/indexes | app.indexes.list | Indexes, limits and (?recommendations=1) index recommendations from recent queries (as indexes_list) |
POST /v1/app/workspaces/{ws}/indexes | app.indexes.create | Create a recommended index (as indexes_create; owners and admins; x-csrf-token) |
DELETE /v1/app/workspaces/{ws}/links/{link} | app.links.delete | Unlink two records (Origin + x-csrf-token + Idempotency-Key, session younger than 12 h, member role) |
POST /v1/app/workspaces/{ws}/links | app.links.create | Link two records (Origin + x-csrf-token + Idempotency-Key, session younger than 12 h, member role) |
GET /v1/app/workspaces/{ws}/notification-settings | app.notifications.settings | Your notification email choice in this workspace |
PUT /v1/app/workspaces/{ws}/notification-settings | app.notifications.settings.update | Email: off | immediate | daily (Origin + x-csrf-token, session younger than 12 h) |
GET /v1/app/workspaces/{ws}/objects/{object}/aggregate | app.records.aggregate | Counts, sums, averages, minimums and maximums, grouped (as records_aggregate; JSON in the query string) |
GET /v1/app/workspaces/{ws}/objects/{object}/records | app.records.query | Records (as records_query; where/sort as JSON in the query string) |
GET /v1/app/workspaces/{ws}/people | app.people | Display names of this workspace's members and agents, keyed by actor id (user:…, agent:…) |
DELETE /v1/app/workspaces/{ws}/published-views/{published} | app.views.published.revoke | Revoke a published view (Origin + x-csrf-token + Idempotency-Key, session younger than 12 h, member role) |
GET /v1/app/workspaces/{ws}/published-views | app.views.published.list | Your published views |
GET /v1/app/workspaces/{ws}/query-capabilities | app.query.capabilities | Filter operators per field type, aggregate metrics and date buckets (read from the query engine) |
POST /v1/app/workspaces/{ws}/records/restore | app.records.restore | Restore records from the recycle bin (Origin + x-csrf-token + Idempotency-Key, session younger than 12 h, member role) |
POST /v1/app/workspaces/{ws}/records/{record}/archive | app.records.archive | Archive a record (Origin + x-csrf-token + Idempotency-Key, session younger than 12 h, member role) |
GET /v1/app/workspaces/{ws}/records/{record}/files | app.records.files | Files attached to a record |
GET /v1/app/workspaces/{ws}/records/{record}/history | app.records.history | Activity of one record, newest first |
GET /v1/app/workspaces/{ws}/records/{record}/related | app.records.related | Linked records (as relationships_list) |
POST /v1/app/workspaces/{ws}/records/{record}/unarchive | app.records.unarchive | Unarchive a record (Origin + x-csrf-token + Idempotency-Key, session younger than 12 h, member role) |
DELETE /v1/app/workspaces/{ws}/records/{record} | app.records.delete | Move a record to the recycle bin (Origin + x-csrf-token + Idempotency-Key, session younger than 12 h, member role) |
GET /v1/app/workspaces/{ws}/records/{record} | app.records.get | One record |
PATCH /v1/app/workspaces/{ws}/records/{record} | app.records.update | Update a record with its version; ?view= checks a Kanban view's WIP limits (Origin + x-csrf-token + Idempotency-Key, session younger than 12 h, member role) |
POST /v1/app/workspaces/{ws}/records | app.records.create | Create a record (Origin + x-csrf-token + Idempotency-Key, session younger than 12 h, member role) |
GET /v1/app/workspaces/{ws}/recycle-bin | app.records.recycle_bin | Recycle bin (as records_recycle_bin) |
POST /v1/app/workspaces/{ws}/restore | app.workspace.restore | Restore from the explorer (Origin + x-csrf-token + Idempotency-Key, session younger than 12 h, owner) |
GET /v1/app/workspaces/{ws}/schema | app.schema | Schema (as schema_inspect) |
GET /v1/app/workspaces/{ws}/search | app.search | Full-text search in one object (?object=) or every object with search enabled (?q=) |
GET /v1/app/workspaces/{ws}/usage | app.usage | Workspace details and quota usage |
POST /v1/app/workspaces/{ws}/views/{view}/publish | app.views.publish | Publish a view read-only through an expiring link (Origin + x-csrf-token + Idempotency-Key, session younger than 12 h, member role) |
GET /v1/app/workspaces/{ws}/views/{view}/render | app.views.render | A view rendered by its display config (docs/APP-VIEWS.md) |
PATCH /v1/app/workspaces/{ws}/views/{view} | app.views.update | Change a view (with its version) (Origin + x-csrf-token + Idempotency-Key, session younger than 12 h, member role) |
GET /v1/app/workspaces/{ws}/views | app.views.list | Saved views (as views_list) |
POST /v1/app/workspaces/{ws}/views | app.views.create | Save a view (Origin + x-csrf-token + Idempotency-Key, session younger than 12 h, member role) |
POST /v1/app/workspaces/{ws}/workspace-imports | app.workspace.import | Import an uploaded data-export bundle into a NEW workspace of your account (dry_run first; D-090) (Origin + x-csrf-token + Idempotency-Key, session younger than 12 h, member role) |