API Reference
Interactive reference for every Rensei REST operation - schemas, auth, and a live "Test it" playground, generated from the OpenAPI spec.
One page per operation, grouped by tag. Each page renders the request/response
schemas from the platform-owned openapi/rensei-api.json copy plus an interactive playground. For
prose guides (auth modes, webhook signing, the worker protocol lifecycle), start
from the API overview.
A2 A
Agent-to-Agent discovery and dispatch listing. The .well-known routes
are fully unauthenticated; the dispatch listing requires a session cookie.
- A2A peer-discovery AgentCard
- A2A (Agent-to-Agent) JSON-RPC endpoint (message/send, tasks/get, tasks/cancel).
- List registered A2A agents for the org
- Register a remote A2A agent
- Get a registered A2A agent
- Update agent trust level
- Delete a registered A2A agent
- Re-fetch AgentCard for an existing registration
- List A2A task dispatches for the authenticated org
Audit
Tamper-evident audit log. The events endpoint requires an rsk_ key or
session cookie. The .well-known/audit-keys JWKS is fully public.
- Per-workspace JWKS for audit signature verification.
- Account-free signed audit-entry verification sample.
- List tamper-evident audit events
Agent Cards
- List agent cards visible to the caller (system + org + optional project).
- Get one agent card, including editor-prefill content.
- Fork an installed reference agent card into a new owned identity.
- Get the marketplace pin and update state for an installed agent card.
- Preview the update from an installed agent-card pin to the current source version.
- Accept a current source version for an installed reference agent card.
Approvals
- List approval gates (pending-approvals feed) for the authenticated org.
- Submit an approve / reject / escalate decision on an approval gate.
Dispatch
- Submit an inbound BYOA agent-dispatch request.
- Get the assembled audit receipt for an inbound dispatch.
- Stream best-effort live execution events for a workflow instance.
M C P
JSON-RPC 2.0 over HTTP POST. Exposes per-session workflow tools, A2A peer agents, and agent memory (recall/remember) to running agent subprocesses.
- BYOA MCP facade (JSON-RPC 2.0)
- Per-session MCP tool surface (initialize, tools/list, tools/call) over JSON-RPC.
C L I
- Look up agent sessions by Linear issue identifier.
- Resolve the authenticated org context for a CLI key or user token.
- List the organizations (workspaces) the authenticated principal belongs to.
Worker Protocol
Endpoints used by the af / rensei-tui daemon to register workers,
heartbeat, poll for queued work, and report session lifecycle events.
Auth: runtime JWT (Bearer eyJ…) on all post-registration calls.
- Trigger credential rotation fan-out
- SSE stream for credential rotation events
- Resolve credential env map for a session
- Mint a short-lived GitHub installation token for a repo
- Post merge-queue landing verdict
- List daemon mutation history for a host
- Enqueue a daemon-config mutation
- Cancel an undelivered daemon mutation
- Upsert plugin verb option snapshots
- Publish a local plugin source version
- Acknowledge Donmai's durable privileged-verification claim
- Poll for a pending plugin verb invocation
- Post plugin verb invocation result
- Confirm Donmai terminal lease acknowledgement and authorize continuation
- Observe privileged-verification finalization status
- Get queued session detail for cloud runners
- Post agent activity (thought/action/response)
- Explicitly claim a pre-queued session
- Post completion summary
- Update Linear agent session with external URLs
- Check session file reservation conflicts
- Release specific file locks
- Release all file locks for a session
- Reserve file lock for a session
- ACK inbox message (Redis XACK)
- Refresh issue lock TTL
- Worker rejection of a pre-claimed session
- Post milestone progress message
- Record a routing observation (MAB reward)
- Sample MAB router for provider selection
- Post security scan event
- Read session state
- FSM status transition
- Lightweight step-level heartbeat
- Ingest batched interview token-delta frames
- Report tool execution error
- Transfer session to another worker
- Get worker detail
- Deregister a worker
- AF-compatible worker heartbeat
- Poll for queued work
- Refresh expired runtime JWT
- AF-compatible worker registration
Policies
- List A2A Cedar policies for a project in the authenticated org.
- List Cedar policies for the authenticated org.
- Get one Cedar policy with its version history.
Incidents
- List incidents for the authenticated org.
- Get incident summary counts (by status, by severity) and MTTR.
Interactive sessions
- List interactive sessions visible to the caller.
- Launch a new interactive PTY-attach session.
- Get one interactive session's detail.
- Cooperatively stop an interactive session.
- Mint a short-lived relay attach token (driver/viewer for users; host for the provisioning daemon) for an interactive session.
Notifications
- Register (or refresh) a push device token for the authenticated user.
- Revoke a push device token owned by the authenticated user.
- Return the VAPID public key for browser web-push subscription.
- Store a browser web-push subscription for the authenticated user.
Authentication
OAuth 2.0 M2M token endpoint and API key management.
Org
B Y O A
- List BYOA requester registrations for the org.
- Create a requester registration and mint its bound dispatch key (token returned once).
Organizations
Org Keys
- List API keys for the active org (metadata only).
- Create an org-scoped API key (full secret returned once). Deprecated - use POST /api/org/{orgId}/keys.
- Soft-delete (revoke) an org API key.
Teams
Plugins
Projects
- List projects in the authenticated org (autocomplete-shaped options).
- Get project details.
- Update a project (rename / re-slug / describe).
- Soft-delete a project.
- List runs (workflow instances) across all of a project's workflows.
Authoring
- Store a reviewed synthesis candidate as an isolated proposal.
- Advance a typed builder conversation without generating or writing.
- Simulate and explain a proposed new canvas against one exact Cedar policy revision.
- Read the current immutable version of a scoped authoring proposal.
- Reject a proposal or apply one to an existing draft workflow.
- Generate a validated workflow or agent-card draft for explicit review.
Memory
Resources
Sessions ( Public)
Public session monitoring endpoints. Most require an rsk_ API key or
session cookie (authenticatePublicRequest). The per-session prompt/stop
actions accept the same auth.
- Platform-wide anonymised aggregate statistics
- Phase-level cycle time, cost, and rework aggregations
- MAB router performance posteriors and recent decisions
- Get session activity time-series
- List enriched sessions for the authenticated org
- Get enriched session detail
- Send a prompt to a running session
- Get Sentry issues linked to a session
- Stop a running session
- Real-time fleet statistics (org-scoped)
Security
Sessions
- Subscribe to the authenticated org's live session-event SSE stream.
- Read the agent topology cold snapshot (nodes, edges, counters).
Telemetry
Templates
Webhooks
Inbound webhook ingestion from Linear, GitHub, GitHub Actions, and Vercel.
Authenticated by HMAC signature. Responds with an immediate 200 ACK; all
processing is deferred via after().
Workflows
API Overview
Auth mechanisms and route-group map.
A2A peer-discovery AgentCard
Fully unauthenticated (public) per the A2A spec. Two modes: - No query param: platform-level AgentCard (`scope='system'` rows). - `?org=<slug>`: per-org AgentCard (`scope='org'` cards with `trust.publish_to_a2a=true`). `Cache-Control: no-store` on all responses.