Hub API report

Pull request #60 · commit 7ba87c2f2a · 2026-10-19 21:56 UTC · the CI run

All API tests pass

Requests

215/215

Bruno requests passing

Checks

759/759

assertions and tests

Spec coverage

135/504

operations the tests call (27%)

p95, median route

6.57 ms

107 GET routes × 20

Slowest p95

142 ms

/v1/overview

Fuzzing findings

17 server error

API tests (Bruno)

The collection in api-tests/bruno, run against a scratch hub: no database, no node daemon, no git host. A failing request fails the pull request.

hub3 requests

Request	Call	Status	ms	Size	Result
Read the hub's identity	GET /v1/hub/identity	200	21.0	99 B	pass
Read the hub's overview	GET /v1/overview	200	8.00	202 B	pass
Answer 404 for an unknown endpoint	GET /v1/no-such-endpoint	404	4.00	28 B	pass

skills8 requests

Request	Call	Status	ms	Size	Result
List skills on an empty hub	GET /v1/skills	200	3.00	13 B	pass
Create a skill	POST /v1/skills	201	91.0	358 B	pass
Read the skill back	GET /v1/skills/pdf-forms	200	16.0	657 B	pass
Change a skill's title and tags	PUT /v1/skills/pdf-forms	200	85.0	374 B	pass
List skills after the change	GET /v1/skills	200	23.0	377 B	pass
Archive a skill	POST /v1/skills/pdf-forms/archive	200	32.0	383 B	pass
Answer 404 for an unknown skill	GET /v1/skills/no-such-skill	404	3.00	36 B	pass
Refuse a create without a title	POST /v1/skills	400	5.00	53 B	pass

prompts8 requests

Request	Call	Status	ms	Size	Result
List the built-in prompts	GET /v1/prompts	200	6.00	5.3 KiB	pass
Create a system prompt	POST /v1/prompts	201	116	282 B	pass
Read the created prompt back	GET /v1/prompts/planner	200	4.00	525 B	pass
Edit the prompt's details	PUT /v1/prompts/planner	200	33.0	291 B	pass
List the prompts after the edit	GET /v1/prompts	200	3.00	5.5 KiB	pass
Archive the prompt	POST /v1/prompts/planner/archive	200	26.0	300 B	pass
Answer 404 for an unknown prompt id	GET /v1/prompts/no-such-prompt	404	4.00	37 B	pass
Reject a create body without a title	POST /v1/prompts	400	3.00	53 B	pass

rules8 requests

Request	Call	Status	ms	Size	Result
List the owner's rules on an empty hub	GET /v1/laws/rules	200	4.00	87 B	pass
Add a rule	POST /v1/laws/rules	201	5.00	325 B	pass
List the rules after adding one	GET /v1/laws/rules	200	2.00	412 B	pass
Rename a rule	PUT /v1/laws/rules/R-001	200	10.0	334 B	pass
List the rules after a rename	GET /v1/laws/rules	200	5.00	421 B	pass
Delete a rule	DELETE /v1/laws/rules/R-001	200	5.00	19 B	pass
Answer 404 for an unknown rule	DELETE /v1/laws/rules/no-such-rule	404	5.00	40 B	pass
Refuse a rule whose body is not a JSON object	POST /v1/laws/rules	400	5.00	42 B	pass

providers8 requests

Request	Call	Status	ms	Size	Result
List the providers	GET /v1/providers	200	2.00	4.4 KiB	pass
Add a provider	POST /v1/providers	201	82.0	204 B	pass
Read the provider back	GET /v1/providers/scratch-provider	200	4.00	204 B	pass
Replace the provider's settings	PUT /v1/providers/scratch-provider	200	48.0	204 B	pass
List the providers again	GET /v1/providers	200	2.00	4.6 KiB	pass
Delete the provider	DELETE /v1/providers/scratch-provider	200	35.0	30 B	pass
Answer 404 for an unknown provider	GET /v1/providers/no-such-provider	404	4.00	42 B	pass
Refuse a provider body that does not parse	POST /v1/providers	400	2.00	85 B	pass

vault8 requests

Request	Call	Status	ms	Size	Result
Show the vault's state	GET /v1/vault	200	2.00	245 B	pass
List the vault's entries before any secret of the owner's	GET /v1/vault/secrets	200	3.00	695 B	pass
Create a secret	POST /v1/vault/secrets	200	39.0	333 B	pass
Change a secret's label	PATCH /v1/vault/secrets/sec_f2pia2hfc5zv	200	96.0	342 B	pass
Read the secret's metadata back from the list	GET /v1/vault/secrets	200	2.00	1.0 KiB	pass
Delete a secret	DELETE /v1/vault/secrets/sec_f2pia2hfc5zv	204	43.0	0 B	pass
Answer 404 for an unknown secret id	DELETE /v1/vault/secrets/sec_doesnotexist	404	4.00	26 B	pass
Refuse a secret body without a value	POST /v1/vault/secrets	400	1.00	53 B	pass

settings7 requests

Request	Call	Status	ms	Size	Result
Read the hub's settings	GET /v1/settings	200	2.00	1.3 KiB	pass
Save a valid change to the settings	PUT /v1/settings	200	4.00	1.2 KiB	pass
Refuse a settings value out of range	PUT /v1/settings	400	1.00	44 B	pass
Refuse a settings body that is not valid JSON for the type	PUT /v1/settings	400	4.00	94 B	pass
Read the saved change back	GET /v1/settings	200	1.00	1.3 KiB	pass
Check the session is signed in	GET /v1/auth/check	200	2.00	11 B	pass
Refuse a sign-in with a wrong owner token	POST /v1/auth/session	401	1.00	39 B	pass

plaza20 requests

Request	Call	Status	ms	Size	Result
List the tasks on an empty hub	GET /v1/tasks	200	2.00	12 B	pass
Open a project for the tasks	POST /v1/projects	201	60.0	659 B	pass
Create a task	POST /v1/tasks	201	1.00	346 B	pass
Read the task back	GET /v1/tasks/t1	200	2.00	346 B	pass
List the tasks after a create	GET /v1/tasks	200	1.00	358 B	pass
Withdraw an open task	DELETE /v1/tasks/t1	200	1.00	359 B	pass
Answer 404 for an unknown task	GET /v1/tasks/t999999	404	2.00	35 B	pass
Refuse a task with no goal	POST /v1/tasks	400	2.00	75 B	pass
Read the board	GET /v1/board	200	2.00	134 B	pass
Refuse a board post from an unknown agent	POST /v1/board	404	1.00	37 B	pass
Refuse a board post with an empty subject	POST /v1/board	400	2.00	37 B	pass
Create a task others will run after	POST /v1/tasks	201	2.00	301 B	pass
Create a task that runs after another	POST /v1/tasks	201	3.00	320 B	pass
List only the tasks that can be claimed now	GET /v1/tasks?ready=true	200	11.0	313 B	pass
Refuse a ready filter that is not true or false	GET /v1/tasks?ready=maybe	400	1.00	54 B	pass
Refuse links that would close a cycle	PATCH /v1/tasks/t2	400	2.00	80 B	pass
Relink an open task	PATCH /v1/tasks/t3	200	2.00	311 B	pass
Answer 404 for relinking an unknown task	PATCH /v1/tasks/t999999	404	1.00	35 B	pass
Refuse a task outside a project	POST /v1/tasks	400	1.00	93 B	pass
Refuse a task for an unknown project	POST /v1/tasks	404	1.00	38 B	pass

library40 requests

Request	Call	Status	ms	Size	Result
List the library's tool versions	GET /v1/library	200	3.00	2 B	pass
Answer 404 for files of an unknown tool version	GET /v1/library/no-such-tool/1/files	404	2.00	27 B	pass
Answer 409 when reviewing an unknown tool version	POST /v1/library/no-such-tool/1/review	409	2.00	27 B	pass
Answer 400 when a review has no approve field	POST /v1/library/no-such-tool/1/review	400	5.00	54 B	pass
Answer 404 when deleting an unknown tool version	DELETE /v1/library/no-such-tool/1	404	1.00	27 B	pass
List the projects	GET /v1/projects	200	2.00	924 B	pass
Answer 404 for an unknown project	GET /v1/projects/no-such-project	404	2.00	27 B	pass
Answer 409 when approving an unknown project	POST /v1/projects/no-such-project/approve	409	2.00	44 B	pass
Answer 404 for an unknown project's task graph	GET /v1/projects/no-such-project/graph	404	2.00	27 B	pass
List a project's agents, none yet	GET /v1/projects/pr1/members	200	2.00	2 B	pass
Answer 404 for an unknown project's agents	GET /v1/projects/no-such-project/members	404	2.00	27 B	pass
Refuse to add an agent with no cid	POST /v1/projects/pr1/members	400	2.00	60 B	pass
Answer 404 when adding an unknown agent	POST /v1/projects/pr1/members	404	3.00	25 B	pass
Answer 404 when benching an agent not on the project	DELETE /v1/projects/pr1/members/4242	404	2.00	44 B	pass
Pause a project	POST /v1/projects/pr1/pause	200	2.00	995 B	pass
Resume a paused project	POST /v1/projects/pr1/resume	200	2.00	1.0 KiB	pass
Refuse a project with no title	POST /v1/projects	400	13.0	45 B	pass
Open a project to archive	POST /v1/projects	201	93.0	619 B	pass
Archive a project	POST /v1/projects/pr2/archive	200	2.00	694 B	pass
Refuse a task for an archived project	POST /v1/tasks	409	2.00	58 B	pass
Refuse to resume an archived project	POST /v1/projects/pr2/resume	409	2.00	35 B	pass
Answer 404 when pausing an unknown project	POST /v1/projects/no-such-project/pause	404	5.00	27 B	pass
Answer 404 when moving an unknown task into a project	POST /v1/tasks/t999/move	404	5.00	32 B	pass
Refuse to move a task out of its project	POST /v1/tasks/t1/move	409	4.00	70 B	pass
Refuse a move that names no project	POST /v1/tasks/t1/move	400	2.00	46 B	pass
Suggest no agents for a project nobody worked on	GET /v1/projects/pr1/suggested-members	200	2.00	2 B	pass
Answer 404 for an unknown project's suggested agents	GET /v1/projects/no-such-project/suggested-members	404	3.00	27 B	pass
Read a project's settings, none set yet	GET /v1/projects/pr1/settings	200	4.00	2 B	pass
Override a project's effort and task budget	PATCH /v1/projects/pr1/settings	200	2.00	36 B	pass
Refuse an effort the plaza does not know	PATCH /v1/projects/pr1/settings	400	2.00	101 B	pass
Refuse a setting projects do not have	PATCH /v1/projects/pr1/settings	400	2.00	209 B	pass
Show where each of a project's settings comes from	GET /v1/projects/pr1/settings/effective	200	2.00	562 B	pass
Set a project's effort back to the plaza's	PATCH /v1/projects/pr1/settings	200	3.00	20 B	pass
Answer 404 for an unknown project's settings	GET /v1/projects/no-such-project/settings	404	2.00	27 B	pass
Read a project's budget, none set aside yet	GET /v1/projects/pr1/budget	200	2.00	55 B	pass
Set credits aside for a project	POST /v1/projects/pr1/budget	200	3.00	57 B	pass
Give some of a project's budget back to the plaza	POST /v1/projects/pr1/budget	200	3.00	56 B	pass
Refuse to move no credits	POST /v1/projects/pr1/budget	400	3.00	28 B	pass
Refuse to give back more than a project has	POST /v1/projects/pr1/budget	409	2.00	102 B	pass
Refuse to set budget aside for an archived project	POST /v1/projects/pr2/budget	409	2.00	66 B	pass

mcp10 requests

Request	Call	Status	ms	Size	Result
List the MCP servers on an empty hub	GET /v1/mcp/servers	200	2.00	2 B	pass
Add an MCP server	POST /v1/mcp/servers	200	2.00	505 B	pass
Read the MCP server back	GET /v1/mcp/servers/test-server	200	1.00	505 B	pass
Change an MCP server's name	PATCH /v1/mcp/servers/test-server	200	1.00	508 B	pass
Answer 404 for an unknown MCP server	GET /v1/mcp/servers/no-such-server	404	2.00	55 B	pass
Refuse an MCP server with an invalid id	POST /v1/mcp/servers	400	2.00	110 B	pass
Delete an MCP server	DELETE /v1/mcp/servers/test-server	204	2.00	0 B	pass
Create an MCP token	POST /v1/hub-mcp/tokens	201	2.00	252 B	pass
List the MCP tokens	GET /v1/hub-mcp/tokens	200	2.00	183 B	pass
Revoke an MCP token	DELETE /v1/hub-mcp/tokens/mcp_27f17a1932f3	204	2.00	0 B	pass

metrics11 requests

Request	Call	Status	ms	Size	Result
Read the metric catalog	GET /v1/metrics/catalog	200	7.00	28.4 KiB	pass
Compose the overview view on an empty hub	GET /v1/metrics/view?tab=overview&range=24h	200	11.0	3.7 KiB	pass
Refuse a view with an unknown range	GET /v1/metrics/view?tab=overview&range=2w	400	4.00	75 B	pass
Read a metric series grouped by all	POST /v1/metrics/query	200	5.00	13 B	pass
Refuse a query with an unknown group	POST /v1/metrics/query	400	7.00	88 B	pass
Read the metrics settings	GET /v1/metrics/settings	200	5.00	292 B	pass
Answer 404 for the scrape endpoint while OpenMetrics is off	GET /metrics	404	2.00	21 B	pass
Summarize usage over a valid window	GET /v1/usage/summary?from=0&to=1000	200	4.00	231 B	pass
Refuse a usage window that ends before it starts	GET /v1/usage/summary?from=2000&to=1000	400	4.00	42 B	pass
List the model prices	GET /v1/prices	200	8.00	488.7 KiB	pass
Answer 404 for a model with no price	GET /v1/prices/no-such-model-xyz	404	8.00	42 B	pass

joining17 requests

Request	Call	Status	ms	Size	Result
List the node join codes on an empty hub	GET /v1/nodes/codes	200	4.00	2 B	pass
Issue a join code for a new node	POST /v1/nodes/codes	201	8.00	221 B	pass
List the join codes shows the new code as active	GET /v1/nodes/codes	200	1.00	120 B	pass
Revoke an unused node join code	DELETE /v1/nodes/codes/c1	200	1.00	26 B	pass
List the join codes after revoking shows the code as revoked	GET /v1/nodes/codes	200	1.00	121 B	pass
Answer 404 when revoking an unknown node join code	DELETE /v1/nodes/codes/c999999	404	3.00	24 B	pass
Answer 400 when the node join code body is not JSON	POST /v1/nodes/codes	400	9.00	111 B	pass
Refuse a node join with a bad join code	POST /v1/nodes/join	403	2.00	39 B	pass
List the workstation join codes on an empty hub	GET /v1/stations/codes	200	1.00	2 B	pass
Answer 400 when the workstation join code body is not JSON	POST /v1/stations/codes	400	2.00	111 B	pass
Answer 404 when revoking an unknown workstation join code	DELETE /v1/stations/codes/c999999	404	2.00	24 B	pass
Refuse a workstation join with a bad join code	POST /v1/stations/join	403	2.00	95 B	pass
Answer 404 when stopping an unknown node	POST /v1/nodes/n999/stop	404	2.00	24 B	pass
Answer 404 when resuming an unknown node	POST /v1/nodes/n999/resume	404	2.00	24 B	pass
Stopping the hub's own node n0 takes it out of service	POST /v1/nodes/n0/stop	200	2.00	310 B	pass
Resuming the hub's own node n0 puts it back in service	POST /v1/nodes/n0/resume	200	2.00	310 B	pass
A dry-run rebalance lists its moves and starts none	POST /v1/nodes/rebalance	200	2.00	28 B	pass

agents13 requests

Request	Call	Status	ms	Size	Result
List the agents on a hub with no node	GET /v1/agents	200	2.00	2 B	pass
Answer 404 for an agent that does not exist	GET /v1/agents/999999	404	3.00	25 B	pass
Answer 400 for an agent id that is not a number	GET /v1/agents/not-a-number	400	1.00	32 B	pass
Answer 404 when deleting an agent that does not exist	DELETE /v1/agents/999999	404	2.00	25 B	pass
List the roles before any custom role exists	GET /v1/roles	200	3.00	52.0 KiB	pass
Refuse a custom role with missing fields	POST /v1/roles	400	3.00	62 B	pass
Create a custom role	POST /v1/roles	200	1.00	278 B	pass
Read the custom role back from the list	GET /v1/roles	200	1.00	52.4 KiB	pass
Change a custom role by saving it again	POST /v1/roles	200	2.00	322 B	pass
Delete a custom role	DELETE /v1/roles/scout-test	200	1.00	34 B	pass
Answer 404 when deleting a role that is already gone	DELETE /v1/roles/scout-test	404	1.00	30 B	pass
List the bench on a hub with no node	GET /v1/agents?project=bench	200	1.00	2 B	pass
Answer 404 for an unknown project's roster	GET /v1/agents?project=no-such-project	404	1.00	38 B	pass

governance11 requests

Request	Call	Status	ms	Size	Result
List the approvals on an empty hub	GET /v1/approvals	200	1.00	2 B	pass
Read an agent's permission mode before any change	GET /v1/agents/7/permissions	200	4.00	40 B	pass
Set an agent's permission mode to read_only	PUT /v1/agents/7/permissions	200	31.0	20 B	pass
Read back the permission mode after the change	GET /v1/agents/7/permissions	200	2.00	37 B	pass
Refuse a permission mode that is not one of the three	PUT /v1/agents/7/permissions	400	2.00	77 B	pass
Decide an approval that does not exist	POST /v1/approvals/no-such-approval	404	2.00	28 B	pass
List the sanctions on an empty hub	GET /v1/sanctions	200	2.00	33 B	pass
Lift a sanction that does not exist	POST /v1/sanctions/999999/lift	404	2.00	30 B	pass
Refuse a default decision model without a provider and model	PUT /v1/decisions/default	400	3.00	68 B	pass
List the agent proposals on an empty hub	GET /v1/agent-proposals	200	3.00	2 B	pass
Approve an agent proposal that does not exist	POST /v1/agent-proposals/no-such-proposal/approve	409	2.00	40 B	pass

foundry9 requests

Request	Call	Status	ms	Size	Result
List the datasets (empty on a fresh hub)	GET /v1/foundry/datasets	200	6.00	2 B	pass
List the jobs (empty on a fresh hub)	GET /v1/foundry/jobs	200	2.00	2 B	pass
Get a job that does not exist	GET /v1/foundry/jobs/no-such-job	404	2.00	23 B	pass
List the events of a job that does not exist	GET /v1/foundry/jobs/no-such-job/events?after=0	404	1.00	23 B	pass
Export a dataset from a body that is not JSON	POST /v1/foundry/datasets	400	2.00	58 B	pass
Upload a dataset with no file named	POST /v1/foundry/datasets/upload	400	1.00	41 B	pass
List the IDE's workspaces (only project repos on a fresh hub)	GET /v1/ide/workspaces	200	5.00	337 B	pass
Read the checkpoints of a workspace that does not exist	GET /v1/ide/workspaces/repo:no-such-repo@main/checkpoints	404	2.00	47 B	pass
Read the checkpoints of a malformed workspace id	GET /v1/ide/workspaces/not-a-workspace/checkpoints	400	2.00	66 B	pass

e2b8 requests

Request	Call	Status	ms	Size	Result
Create an E2B key for the reads	POST /v1/e2b/keys	200	34.0	131 B	pass
List the running sandboxes (empty)	GET /e2b/sandboxes	200	3.00	2 B	pass
List the sandboxes by state (empty)	GET /e2b/v2/sandboxes?state=running,paused	200	4.00	2 B	pass
List every sandbox for the owner's console (empty)	GET /v1/e2b/sandboxes	200	3.00	16 B	pass
Get a sandbox that does not exist	GET /e2b/sandboxes/sb0000000000000000	404	2.00	87 B	pass
Refuse the sandbox list without an E2B key	GET /e2b/sandboxes	401	12.0	92 B	pass
List the templates and their builds (empty)	GET /v1/e2b/templates	200	2.00	16 B	pass
Revoke the E2B key	DELETE /v1/e2b/keys/e2k-fbbdc6158a94	200	37.0	11 B	pass

conversations15 requests

Request	Call	Status	ms	Size	Result
List the owner's conversations on a hub with none	GET /v1/owner/conversations	200	1.00	2 B	pass
Refuse a conversation while no orchestrator is connected	POST /v1/owner/conversations	409	3.00	118 B	pass
Refuse a conversation with no text	POST /v1/owner/conversations	400	2.00	61 B	pass
Refuse a conversation with an empty message	POST /v1/owner/conversations	400	3.00	34 B	pass
Answer 404 for an unknown conversation	GET /v1/owner/conversations/conv-999	404	2.00	32 B	pass
Answer 404 for a message to an unknown conversation	POST /v1/owner/conversations/conv-999/messages	404	2.00	36 B	pass
Answer 404 when renaming an unknown conversation	PATCH /v1/owner/conversations/conv-999	404	2.00	36 B	pass
Refuse an empty title	PATCH /v1/owner/conversations/conv-999	400	2.00	37 B	pass
Answer 404 for an unknown conversation's transcript	GET /v1/owner/conversations/conv-999/transcript	404	15.0	32 B	pass
List the conversations with the archived ones	GET /v1/owner/conversations?archived=true	200	2.00	2 B	pass
Answer 404 for an unknown conversation's draft	GET /v1/owner/conversations/conv-999/draft	404	2.00	32 B	pass
Answer 404 when editing an unknown conversation's draft	PATCH /v1/owner/conversations/conv-999/draft	404	2.00	32 B	pass
Refuse a draft edit with a field drafts do not have	PATCH /v1/owner/conversations/conv-999/draft	400	2.00	162 B	pass
Answer 404 when starting an unknown conversation's project	POST /v1/owner/conversations/conv-999/start	404	2.00	36 B	pass
Refuse a start that names no revision	POST /v1/owner/conversations/conv-999/start	400	2.00	65 B	pass

weft7 requests

Request	Call	Status	ms	Size	Result
Show whether Weft is running on a fresh hub	GET /v1/weft	200	2.00	46 B	pass
List the Weft repositories on a fresh hub	GET /v1/weft/repos	200	4.00	361 B	pass
List the language packs Weft has loaded	GET /v1/weft/packs	200	3.00	318 B	pass
List the Weft keys, with the owner's on a fresh hub	GET /v1/weft/keys	200	3.00	634 B	pass
List the Weft operations log, newest first	GET /v1/weft/ops?limit=20	200	10.0	741 B	pass
List the review recipes and the proposals waiting	GET /v1/recipes	200	7.00	556 B	pass
Show the code review recipe as its TOML	GET /v1/recipes/code	200	2.00	6.0 KiB	pass

platforms4 requests

Request	Call	Status	ms	Size	Result
List the git platforms on a fresh hub	GET /v1/platforms	200	2.00	323 B	pass
Start creating the GitHub App	POST /v1/platforms/github/app	200	2.00	129 B	pass
A callback with an unknown state does nothing	GET /v1/platforms/callback?code=x&state=unknown	400	4.00	501 B	pass
An organisation-level token must name its organisation	POST /v1/platforms/tokens	400	2.00	71 B	pass

Timings

Every GET in the spec without path parameters, requested 20 times in a row on the CI runner, slowest p95 first. Times are milliseconds on a shared runner: compare them run to run, not to production. The last column is the p95's change against main.

Route	What it does	Status	p50	p95	max	Size	vs main
/v1/overview	Read the hub's overview	200	6.06	142	142	224 B	+47%
/v1/e2b/sandboxes	List all sandboxes for the owner's console	200	3.97	33.0	33.0	16 B	+1786%
/v1/treasury/journal	List the treasury journal	200	2.92	25.8	25.8	2.3 KiB	+193%
/v1/prices	List the model prices	200	7.13	25.3	25.3	488.7 KiB	+200%
/v1/hub-mcp/calls	List the recent MCP calls	200	5.95	22.6	22.6	12 B	+434%
/v1/hub-mcp/tokens	List the MCP tokens	200	3.70	21.8	21.8	192 B	+649%
/v1/providers	List the providers	200	4.61	21.5	21.5	4.4 KiB	+219%
/v1/files	List the files agents handed in	200	3.37	20.5	20.5	2 B	+210%
/v1/machines	List the machines on this plaza	200	6.33	20.0	20.0	58 B	+168%
/v1/connectors	List the connectors and their settings	200	2.73	19.8	19.8	11.6 KiB	+66%
/v1/acp	Open an editor's ACP socket	409	3.82	19.0	19.0	104 B	+217%
/v1/recipes	List the review recipes and the orchestrator's proposals	200	2.84	18.9	18.9	556 B	new
/v1/usage/series	Show usage over time, bucketed	200	2.08	17.7	17.7	28.0 KiB	+547%
/v1/hub-mcp	Show the hub's MCP server status	200	5.66	17.5	17.5	278 B	+464%
/v1/roles	List the built-in and custom roles	200	4.75	16.4	16.4	52.0 KiB	+87%
/v1/metrics/forecast	Show the capacity forecast	200	4.88	14.2	14.2	187 B	+252%
/v1/ide/audit	List the IDE's audit log	200	2.22	14.0	14.0	2 B	+126%
/v1/stations/codes	List the join codes	200	2.31	12.7	12.7	2 B	+386%
/v1/board	Read the board	200	2.32	12.3	12.3	134 B	+43%
/v1/e2b/keys	List the E2B API keys	200	3.59	10.8	10.8	11 B	+477%
/v1/prompts/rules	List the prompt rules and templates	200	2.76	10.8	10.8	5.5 KiB	+419%
/v1/metrics/slos	List the service-level objectives	200	2.74	10.7	10.7	785 B	+216%
/v1/plaza/state	Show whether the plaza is stopped	200	1.94	10.5	10.5	63 B	+526%
/v1/metrics/settings	Read the metrics settings	200	2.89	10.5	10.5	292 B	+542%
/v1/fleet	List the machines and the agents on them	200	3.70	10.3	10.3	295 B	+365%
/v1/provider-kinds	List the provider kinds you can add	200	4.15	10.3	10.3	8.3 KiB	-0%
/v1/machine	Read this machine's facts	502	4.50	10.1	10.1	101 B	+23%
/v1/decisions/default	Get the default decision model	200	4.25	10.1	10.1	30 B	+65%
/v1/nodes	List the plaza's machines	200	2.54	9.65	9.65	312 B	+311%
/v1/agents	List the agents	200	5.67	9.61	9.61	2 B	+174%
/v1/metrics/alerts	List the alerts and their state	200	2.65	9.61	9.61	2.3 KiB	+121%
/v1/skills/rules	List the skill rules and the template	200	2.29	9.58	9.58	2.3 KiB	+263%
/v1/tasks	List the tasks	200	2.64	9.42	9.42	985 B	+93%
/v1/settings	Get the hub's settings	200	2.90	9.40	9.40	1.3 KiB	+65%
/v1/runs	List the runs on this machine	502	2.69	9.30	9.30	101 B	-44%
/v1/weft	Show whether Weft, the plaza's version control, is running	200	2.27	9.28	9.28	46 B	new
/v1/vault/audit	Read the audit log, verifying it on request	200	2.88	9.27	9.27	1.3 KiB	+375%
/v1/laws	List the laws and how often each refused a call	200	4.67	8.75	8.75	98.9 KiB	+54%
/v1/ide/workspaces	List the IDE's workspaces	200	4.21	8.71	8.71	337 B	+163%
/v1/metrics/export	Export a view as CSV	200	4.45	8.56	8.56	24 B	+64%
/v1/metrics	Scrape the hub's Prometheus metrics	200	2.06	8.34	8.34	5.1 KiB	+334%
/v1/laws/rules	List the owner's rules and overrides	200	2.18	8.32	8.32	87 B	+347%
/v1/templates	List the warm templates	502	2.56	8.19	8.19	101 B	+8%
/v1/acp/sessions	List the editor (ACP) sessions	200	2.16	7.81	7.81	2 B	+23%
/v1/foundry/devices	List the accelerators and the jobs holding them	200	2.14	7.35	7.35	15 B	+69%
/v1/hub	Read the hub's status	502	4.09	7.10	7.10	101 B	+2%
/v1/egress/inject	List the egress injection rules	200	2.45	7.03	7.03	12 B	+351%
/v1/prompts	List the prompts	200	3.18	6.96	6.96	5.3 KiB	+231%
/v1/agora	Show the agora's calls	200	2.85	6.92	6.92	52 B	+91%
/v1/e2b/templates	List the templates and their builds	200	2.44	6.84	6.84	16 B	+325%
/v1/auth/check	Check that the session is signed in	200	2.54	6.78	6.78	11 B	+197%
/v1/node-link	Read this machine's link to a hub	200	2.88	6.59	6.59	81 B	+187%
/v1/treasury	Show the treasury balances	200	2.06	6.57	6.57	759 B	+72%
/v1/vault/secrets	List the vault's entries	200	2.09	6.57	6.57	695 B	+257%
/v1/toolbox	List the toolbox discoveries	200	1.70	6.52	6.52	2 B	+157%
/v1/owner/conversations	List the owner's conversations with the orchestrator	200	2.76	6.32	6.32	2 B	new
/v1/hub/identity	Show the hub's identity	200	2.57	6.23	6.23	99 B	+141%
/v1/society	Show the society: agents, bonds and reputations	200	2.45	6.21	6.21	52 B	-38%
/v1/library	List the library's tool versions	200	2.26	6.20	6.20	2 B	+122%
/v1/foundry/models	List the foundry's models	200	1.40	6.10	6.10	13 B	+72%
/v1/metrics/view	Compose a metrics view	200	4.90	5.95	5.95	3.7 KiB	-30%
/v1/foundry/datasets	List the datasets	200	1.80	5.88	5.88	2 B	+172%
/v1/nodes/codes	List the join codes	200	2.23	5.77	5.77	121 B	+201%
/v1/treasury/wallets	List the agent wallets	200	2.55	5.76	5.76	2 B	+100%
/v1/loops	List the scheduled loops	200	2.37	5.41	5.41	2 B	+75%
/v1/volumes	List the data volumes	502	2.80	5.40	5.40	101 B	+9%
/v1/treasury/series	Show the treasury over time	200	2.42	5.38	5.38	9.9 KiB	+26%
/v1/projects	List the projects	200	2.01	5.23	5.23	1.7 KiB	+43%
/v1/vault/consumers	List each consumer and its resolved entry	200	2.34	5.04	5.04	4.0 KiB	+89%
/v1/agent-proposals	List the agent proposals	200	2.47	4.99	4.99	2 B	+366%
/v1/platforms/callback	Take the browser back from a platform	400	2.18	4.94	4.94	501 B	new
/v1/infractions	List the recent infractions	200	2.36	4.93	4.93	2 B	+71%
/v1/laws/violations	List the recorded refusals of a law	200	2.39	4.88	4.88	2 B	+199%
/v1/mcp/catalog	List the MCP server presets	200	1.43	4.86	4.86	4.2 KiB	+142%
/v1/stations/recordings	List the station recordings, newest first	200	1.68	4.78	4.78	2 B	+335%
/v1/metrics/around	Show what changed around a time	200	3.42	4.61	4.61	202 B	-18%
/v1/stations/link	Open the workstation daemon's link socket	401	1.74	4.54	4.54	61 B	+236%
/v1/foundry/recipes	List the recipes	200	1.63	4.48	4.48	541 B	-46%
/v1/connectors/proposals	List connector proposals, newest first	200	1.38	4.43	4.43	2 B	+137%
/v1/stations/vms	List the workstation VMs	200	2.14	4.42	4.42	2 B	+203%
/v1/ws	Open a socket that streams the hub's events	400	2.60	4.31	4.31	79 B	-32%
/v1/approvals	List the approvals, pending and decided	200	1.35	4.29	4.29	2 B	+152%
/v1/foundry/hf/status	Show the Hugging Face status	200	2.48	4.28	4.28	116 B	-12%
/v1/board/export	Export a board thread as Markdown or JSON	200	2.26	4.26	4.26	69 B	+49%
/v1/motions	List the motions	200	2.74	4.17	4.17	214 B	-31%
/v1/platforms	List the git platforms the plaza is authorized on	200	2.37	4.03	4.03	323 B	new
/v1/vault	Show the vault's state	200	1.61	3.93	3.93	245 B	+101%
/v1/metrics/catalog	Read the metric catalog	200	2.54	3.91	3.91	28.4 KiB	+149%
/v1/metrics/traces	List the kept traces	200	2.05	3.87	3.87	2 B	+136%
/v1/conversations	List the conversations	200	2.19	3.78	3.78	147 B	+13%
/v1/foundry/jobs	List the jobs, newest first	200	1.53	3.78	3.78	2 B	+1%
/v1/stations/audit	List the station audit, newest first	200	1.37	3.57	3.57	2 B	+181%
/v1/metrics/scopes	List the metric scopes	200	2.77	3.47	3.47	6.3 KiB	-1%
/v1/skills/export	Export several skills as one zip	422	1.96	3.32	3.32	24 B	+20%
/v1/stations/recording-defaults	Show the recording defaults for new workstations	200	1.46	3.22	3.22	74 B	+198%
/v1/sanctions	List the sanctions and suspensions	200	1.62	3.12	3.12	33 B	+23%
/v1/robots/species	List the robot species with counts	200	1.31	3.06	3.06	1.2 KiB	-40%
/v1/skills	List the skills, or the archived ones	200	1.77	3.02	3.02	13 B	+138%
/v1/metrics/calls/page	Load the next page of calls	200	2.58	3.01	3.01	351 B	+7%
/v1/metrics/dashboards	Read the saved dashboards	200	1.48	2.99	2.99	50 B	+232%
/v1/stations	List the workstations	200	1.33	2.97	2.97	2 B	+156%
/v1/mcp/servers	List the MCP servers	200	1.45	2.95	2.95	2 B	-4%
/v1/foundry/hf/imports	List the Hugging Face imports	200	1.81	2.93	2.93	14 B	-15%
/v1/usage/calls	List the newest model calls	200	2.13	2.69	2.69	41 B	-1%
/v1/metrics/calls	List the agents' calls	200	1.94	2.34	2.34	2 B	-29%
/v1/usage/summary	Summarize usage over a time window	200	1.89	2.32	2.32	252 B	-66%
/v1/metrics/events	List the metric events	200	1.62	1.89	1.89	2 B	+17%

Fuzzing (Schemathesis)

Requests generated from docs/api/openapi.json: a 5xx answer or a connection dropped without an answer is a finding. 502 and 503 come from the scratch hub's missing node daemon and git host. Reported here; findings do not fail the pull request yet.

Server error17

Operation	What happened
POST /v1/agent-proposals/{id}/approve	1. Test Case ID: wCS9Dk - Server error [502] Bad Gateway: `{"error":"no node 0"}` Reproduce with: curl -X POST http://127.0.0.1:17777/v1/nodes/0/runs
POST /v1/owner/conversations/{id}/messages	1. Test Case ID: D0TuBm - Server error [502] Bad Gateway: `{"error":"127.0.0.1:1 unreachable: cannot connect to 127.0.0.1:1: Connection refused (os error 111)"}` Reproduce with: curl -X POST http://127.0.0.1:17777/v1/runs/0/input
POST /v1/runs	1. Test Case ID: keEZLB - Server error [502] Bad Gateway: `{"error":"127.0.0.1:1 unreachable: cannot connect to 127.0.0.1:1: Connection refused (os error 111)"}` Reproduce with: curl -X POST http://127.0.0.1:17777/v1/runs
POST /v1/skills	1. Test Case ID: RLJhX0 - Server error [503] Service Unavailable: `{"error":"vault sealed"}` Reproduce with: curl -X POST http://127.0.0.1:17777/v1/vault/secrets/0/test
POST /v1/vault/slots	1. Test Case ID: AN6T9k - Server error [502] Bad Gateway: `{"error":"127.0.0.1:1 unreachable: cannot connect to 127.0.0.1:1: Connection refused (os error 111)"}` Reproduce with: curl -X POST http://127.0.0.1:17777/v1/volumes
POST /v1/weft/{rest}	1. Test Case ID: SW5W3q - Server error [502] Bad Gateway: `{"error":"127.0.0.1:2 unreachable: cannot connect to 127.0.0.1:2: Connection refused (os error 111)"}` Reproduce with: curl -X GET http://127.0.0.1:17777/v1/hub
GET /v1/hub-mcp	1. Test Case ID: rQPOBX - Server error [502] Bad Gateway: `{"error":"127.0.0.1:1 unreachable: cannot connect to 127.0.0.1:1: Connection refused (os error 111)"}` Reproduce with: curl -X GET http://127.0.0.1:17777/v1/machine
GET /v1/machines	1. Test Case ID: mM7n1H - Server error [502] Bad Gateway: `{"error":"no node 0"}` Reproduce with: curl -X GET http://127.0.0.1:17777/v1/nodes/0/machine
GET /v1/nodes/{id}/runs	1. Test Case ID: GqQiSI - Server error [502] Bad Gateway: `{"error":"no node 0"}` Reproduce with: curl -X GET http://127.0.0.1:17777/v1/nodes/0/runs
GET /v1/nodes/{id}/stats	1. Test Case ID: g3xxT3 - Server error [502] Bad Gateway: `{"error":"no node 0"}` Reproduce with: curl -X GET http://127.0.0.1:17777/v1/nodes/0/stats
GET /v1/overview	1. Test Case ID: v3LuNP - Server error [502] Bad Gateway: `{"error":"127.0.0.1:1 unreachable: cannot connect to 127.0.0.1:1: Connection refused (os error 111)"}` Reproduce with: curl -X GET http://127.0.0.1:17777/v1/runs
GET /v1/runs/{id}	1. Test Case ID: dRdIN3 - Server error [502] Bad Gateway: `{"error":"127.0.0.1:1 unreachable: cannot connect to 127.0.0.1:1: Connection refused (os error 111)"}` Reproduce with: curl -X GET http://127.0.0.1:17777/v1/runs/0
GET /v1/sanctions	1. Test Case ID: VMxKsa - Server error [502] Bad Gateway: `{"error":"127.0.0.1:1 unreachable: cannot connect to 127.0.0.1:1: Connection refused (os error 111)"}` Reproduce with: curl -X GET http://127.0.0.1:17777/v1/templates
GET /v1/toolbox	1. Test Case ID: t63A6q - Server error [502] Bad Gateway: `{"error":"127.0.0.1:1 unreachable: cannot connect to 127.0.0.1:1: Connection refused (os error 111)"}` Reproduce with: curl -X GET http://127.0.0.1:17777/v1/volumes
GET /v1/weft	1. Test Case ID: xcdiRG - Server error [502] Bad Gateway: `{"error":"127.0.0.1:1 unreachable: cannot connect to 127.0.0.1:1: Connection refused (os error 111)"}` Reproduce with: curl -X DELETE http://127.0.0.1:17777/v1/runs/0
DELETE /v1/stations/codes/{id}	1. Test Case ID: eivy3y - Server error [502] Bad Gateway: `{"error":"127.0.0.1:1 unreachable: cannot connect to 127.0.0.1:1: Connection refused (os error 111)"}` Reproduce with: curl -X DELETE http://127.0.0.1:17777/v1/templates/0
DELETE /v1/vault/slots/{id}	1. Test Case ID: 5mT6Q4 - Server error [502] Bad Gateway: `{"error":"127.0.0.1:1 unreachable: cannot connect to 127.0.0.1:1: Connection refused (os error 111)"}` Reproduce with: curl -X DELETE http://127.0.0.1:17777/v1/volumes/0

Coverage by area

Area	Tested
e2b	7/39
stations	5/38
internal	0/37
agents	5/34
foundry	6/33
metrics	5/27
skills	5/23
projects	17/18
nodes	7/18
vault	5/17
platforms	4/17
ide	2/15
prompts	5/15
mcp	5/13
tasks	6/11
laws	4/10
owner	9/9
providers	5/8
board	2/7
connectors	0/7
treasury	0/6
hub-mcp	3/6
runs	0/5
motions	0/5
library	4/4
files	0/4
weft	2/4
recipes	2/4
egress	0/4
hub	1/3
volumes	0/3
decisions	1/3
toolbox	0/3
loops	0/3
plaza	0/3
roles	3/3
agent-proposals	2/3
prices	2/3
usage	1/3
node-link	0/3
auth	2/3
console	1/3
templates	0/2
acp	0/2
settings	2/2
conversations	0/2
approvals	2/2
sanctions	2/2
reviews	0/2
unfurl	0/2
overview	1/1
machines	0/1
machine	0/1
ws	0/1
provider-kinds	0/1
models	0/1
agora	0/1
society	0/1
infractions	0/1
fleet	0/1
robots	0/1

Made by api-tests/run.sh in the pull request gate. Bodies are scrubbed of tokens and secrets before they are published.