Hub API report

Pull request #61 · commit 0a899497df · 2026-10-19 23:11 UTC · the CI run

All API tests pass

Requests

231/231

Bruno requests passing

Checks

829/829

assertions and tests

Spec coverage

149/527

operations the tests call (28%)

p95, median route

6.29 ms

108 GET routes × 20

Slowest p95

70.2 ms

/v1/overview

Fuzzing findings

16 server error

API tests (Bruno)

The collection in api-tests/bruno, run against a scratch hub: no database, no node daemon, no git host. A failing request fails the pull request.

hub3 requests

Request	Call	Status	ms	Size	Result
Read the hub's identity	GET /v1/hub/identity	200	25.0	99 B	pass
Read the hub's overview	GET /v1/overview	200	6.00	202 B	pass
Answer 404 for an unknown endpoint	GET /v1/no-such-endpoint	404	6.00	28 B	pass

skills8 requests

Request	Call	Status	ms	Size	Result
List skills on an empty hub	GET /v1/skills	200	10.0	13 B	pass
Create a skill	POST /v1/skills	201	70.0	358 B	pass
Read the skill back	GET /v1/skills/pdf-forms	200	3.00	657 B	pass
Change a skill's title and tags	PUT /v1/skills/pdf-forms	200	36.0	374 B	pass
List skills after the change	GET /v1/skills	200	4.00	377 B	pass
Archive a skill	POST /v1/skills/pdf-forms/archive	200	73.0	383 B	pass
Answer 404 for an unknown skill	GET /v1/skills/no-such-skill	404	3.00	36 B	pass
Refuse a create without a title	POST /v1/skills	400	5.00	53 B	pass

prompts8 requests

Request	Call	Status	ms	Size	Result
List the built-in prompts	GET /v1/prompts	200	3.00	5.3 KiB	pass
Create a system prompt	POST /v1/prompts	201	40.0	282 B	pass
Read the created prompt back	GET /v1/prompts/planner	200	2.00	525 B	pass
Edit the prompt's details	PUT /v1/prompts/planner	200	39.0	291 B	pass
List the prompts after the edit	GET /v1/prompts	200	3.00	5.5 KiB	pass
Archive the prompt	POST /v1/prompts/planner/archive	200	90.0	300 B	pass
Answer 404 for an unknown prompt id	GET /v1/prompts/no-such-prompt	404	2.00	37 B	pass
Reject a create body without a title	POST /v1/prompts	400	3.00	53 B	pass

rules8 requests

Request	Call	Status	ms	Size	Result
List the owner's rules on an empty hub	GET /v1/laws/rules	200	4.00	87 B	pass
Add a rule	POST /v1/laws/rules	201	4.00	325 B	pass
List the rules after adding one	GET /v1/laws/rules	200	2.00	412 B	pass
Rename a rule	PUT /v1/laws/rules/R-001	200	4.00	334 B	pass
List the rules after a rename	GET /v1/laws/rules	200	2.00	421 B	pass
Delete a rule	DELETE /v1/laws/rules/R-001	200	4.00	19 B	pass
Answer 404 for an unknown rule	DELETE /v1/laws/rules/no-such-rule	404	3.00	40 B	pass
Refuse a rule whose body is not a JSON object	POST /v1/laws/rules	400	4.00	42 B	pass

providers8 requests

Request	Call	Status	ms	Size	Result
List the providers	GET /v1/providers	200	3.00	4.4 KiB	pass
Add a provider	POST /v1/providers	201	136	204 B	pass
Read the provider back	GET /v1/providers/scratch-provider	200	1.00	204 B	pass
Replace the provider's settings	PUT /v1/providers/scratch-provider	200	116	204 B	pass
List the providers again	GET /v1/providers	200	3.00	4.6 KiB	pass
Delete the provider	DELETE /v1/providers/scratch-provider	200	13.0	30 B	pass
Answer 404 for an unknown provider	GET /v1/providers/no-such-provider	404	4.00	42 B	pass
Refuse a provider body that does not parse	POST /v1/providers	400	4.00	85 B	pass

vault8 requests

Request	Call	Status	ms	Size	Result
Show the vault's state	GET /v1/vault	200	2.00	245 B	pass
List the vault's entries before any secret of the owner's	GET /v1/vault/secrets	200	3.00	695 B	pass
Create a secret	POST /v1/vault/secrets	200	96.0	333 B	pass
Change a secret's label	PATCH /v1/vault/secrets/sec_mbh2drm3vhse	200	37.0	342 B	pass
Read the secret's metadata back from the list	GET /v1/vault/secrets	200	2.00	1.0 KiB	pass
Delete a secret	DELETE /v1/vault/secrets/sec_mbh2drm3vhse	204	37.0	0 B	pass
Answer 404 for an unknown secret id	DELETE /v1/vault/secrets/sec_doesnotexist	404	3.00	26 B	pass
Refuse a secret body without a value	POST /v1/vault/secrets	400	2.00	53 B	pass

settings7 requests

Request	Call	Status	ms	Size	Result
Read the hub's settings	GET /v1/settings	200	3.00	1.3 KiB	pass
Save a valid change to the settings	PUT /v1/settings	200	3.00	1.2 KiB	pass
Refuse a settings value out of range	PUT /v1/settings	400	2.00	44 B	pass
Refuse a settings body that is not valid JSON for the type	PUT /v1/settings	400	2.00	94 B	pass
Read the saved change back	GET /v1/settings	200	1.00	1.3 KiB	pass
Check the session is signed in	GET /v1/auth/check	200	3.00	11 B	pass
Refuse a sign-in with a wrong owner token	POST /v1/auth/session	401	2.00	39 B	pass

plaza20 requests

Request	Call	Status	ms	Size	Result
List the tasks on an empty hub	GET /v1/tasks	200	3.00	12 B	pass
Open a project for the tasks	POST /v1/projects	201	42.0	674 B	pass
Create a task	POST /v1/tasks	201	4.00	346 B	pass
Read the task back	GET /v1/tasks/t1	200	1.00	346 B	pass
List the tasks after a create	GET /v1/tasks	200	2.00	358 B	pass
Withdraw an open task	DELETE /v1/tasks/t1	200	1.00	359 B	pass
Answer 404 for an unknown task	GET /v1/tasks/t999999	404	2.00	35 B	pass
Refuse a task with no goal	POST /v1/tasks	400	2.00	75 B	pass
Read the board	GET /v1/board	200	2.00	134 B	pass
Refuse a board post from an unknown agent	POST /v1/board	404	2.00	37 B	pass
Refuse a board post with an empty subject	POST /v1/board	400	2.00	37 B	pass
Create a task others will run after	POST /v1/tasks	201	3.00	301 B	pass
Create a task that runs after another	POST /v1/tasks	201	4.00	320 B	pass
List only the tasks that can be claimed now	GET /v1/tasks?ready=true	200	6.00	313 B	pass
Refuse a ready filter that is not true or false	GET /v1/tasks?ready=maybe	400	4.00	54 B	pass
Refuse links that would close a cycle	PATCH /v1/tasks/t2	400	1.00	80 B	pass
Relink an open task	PATCH /v1/tasks/t3	200	4.00	311 B	pass
Answer 404 for relinking an unknown task	PATCH /v1/tasks/t999999	404	2.00	35 B	pass
Refuse a task outside a project	POST /v1/tasks	400	2.00	93 B	pass
Refuse a task for an unknown project	POST /v1/tasks	404	2.00	38 B	pass

library40 requests

Request	Call	Status	ms	Size	Result
List the library's tool versions	GET /v1/library	200	2.00	2 B	pass
Answer 404 for files of an unknown tool version	GET /v1/library/no-such-tool/1/files	404	2.00	27 B	pass
Answer 409 when reviewing an unknown tool version	POST /v1/library/no-such-tool/1/review	409	2.00	27 B	pass
Answer 400 when a review has no approve field	POST /v1/library/no-such-tool/1/review	400	3.00	54 B	pass
Answer 404 when deleting an unknown tool version	DELETE /v1/library/no-such-tool/1	404	2.00	27 B	pass
List the projects	GET /v1/projects	200	1.00	939 B	pass
Answer 404 for an unknown project	GET /v1/projects/no-such-project	404	1.00	27 B	pass
Answer 409 when approving an unknown project	POST /v1/projects/no-such-project/approve	409	3.00	44 B	pass
Answer 404 for an unknown project's task graph	GET /v1/projects/no-such-project/graph	404	2.00	27 B	pass
List a project's agents, none yet	GET /v1/projects/pr1/members	200	5.00	2 B	pass
Answer 404 for an unknown project's agents	GET /v1/projects/no-such-project/members	404	2.00	27 B	pass
Refuse to add an agent with no cid	POST /v1/projects/pr1/members	400	3.00	60 B	pass
Answer 404 when adding an unknown agent	POST /v1/projects/pr1/members	404	4.00	25 B	pass
Answer 404 when benching an agent not on the project	DELETE /v1/projects/pr1/members/4242	404	4.00	44 B	pass
Pause a project	POST /v1/projects/pr1/pause	200	4.00	1010 B	pass
Resume a paused project	POST /v1/projects/pr1/resume	200	2.00	1.1 KiB	pass
Refuse a project with no title	POST /v1/projects	400	5.00	45 B	pass
Open a project to archive	POST /v1/projects	201	27.0	634 B	pass
Archive a project	POST /v1/projects/pr2/archive	200	2.00	709 B	pass
Refuse a task for an archived project	POST /v1/tasks	409	2.00	58 B	pass
Refuse to resume an archived project	POST /v1/projects/pr2/resume	409	3.00	35 B	pass
Answer 404 when pausing an unknown project	POST /v1/projects/no-such-project/pause	404	2.00	27 B	pass
Answer 404 when moving an unknown task into a project	POST /v1/tasks/t999/move	404	2.00	32 B	pass
Refuse to move a task out of its project	POST /v1/tasks/t1/move	409	4.00	70 B	pass
Refuse a move that names no project	POST /v1/tasks/t1/move	400	2.00	46 B	pass
Suggest no agents for a project nobody worked on	GET /v1/projects/pr1/suggested-members	200	2.00	2 B	pass
Answer 404 for an unknown project's suggested agents	GET /v1/projects/no-such-project/suggested-members	404	2.00	27 B	pass
Read a project's settings, none set yet	GET /v1/projects/pr1/settings	200	3.00	2 B	pass
Override a project's effort and task budget	PATCH /v1/projects/pr1/settings	200	3.00	36 B	pass
Refuse an effort the plaza does not know	PATCH /v1/projects/pr1/settings	400	2.00	101 B	pass
Refuse a setting projects do not have	PATCH /v1/projects/pr1/settings	400	5.00	209 B	pass
Show where each of a project's settings comes from	GET /v1/projects/pr1/settings/effective	200	3.00	562 B	pass
Set a project's effort back to the plaza's	PATCH /v1/projects/pr1/settings	200	22.0	20 B	pass
Answer 404 for an unknown project's settings	GET /v1/projects/no-such-project/settings	404	3.00	27 B	pass
Read a project's budget, none set aside yet	GET /v1/projects/pr1/budget	200	3.00	55 B	pass
Set credits aside for a project	POST /v1/projects/pr1/budget	200	5.00	57 B	pass
Give some of a project's budget back to the plaza	POST /v1/projects/pr1/budget	200	4.00	56 B	pass
Refuse to move no credits	POST /v1/projects/pr1/budget	400	3.00	28 B	pass
Refuse to give back more than a project has	POST /v1/projects/pr1/budget	409	5.00	102 B	pass
Refuse to set budget aside for an archived project	POST /v1/projects/pr2/budget	409	2.00	66 B	pass

mcp10 requests

Request	Call	Status	ms	Size	Result
List the MCP servers on an empty hub	GET /v1/mcp/servers	200	3.00	2 B	pass
Add an MCP server	POST /v1/mcp/servers	200	2.00	505 B	pass
Read the MCP server back	GET /v1/mcp/servers/test-server	200	1.00	505 B	pass
Change an MCP server's name	PATCH /v1/mcp/servers/test-server	200	8.00	508 B	pass
Answer 404 for an unknown MCP server	GET /v1/mcp/servers/no-such-server	404	2.00	55 B	pass
Refuse an MCP server with an invalid id	POST /v1/mcp/servers	400	2.00	110 B	pass
Delete an MCP server	DELETE /v1/mcp/servers/test-server	204	1.00	0 B	pass
Create an MCP token	POST /v1/hub-mcp/tokens	201	2.00	252 B	pass
List the MCP tokens	GET /v1/hub-mcp/tokens	200	1.00	183 B	pass
Revoke an MCP token	DELETE /v1/hub-mcp/tokens/mcp_e369cad9fc2f	204	1.00	0 B	pass

metrics11 requests

Request	Call	Status	ms	Size	Result
Read the metric catalog	GET /v1/metrics/catalog	200	1.00	28.4 KiB	pass
Compose the overview view on an empty hub	GET /v1/metrics/view?tab=overview&range=24h	200	4.00	3.7 KiB	pass
Refuse a view with an unknown range	GET /v1/metrics/view?tab=overview&range=2w	400	2.00	75 B	pass
Read a metric series grouped by all	POST /v1/metrics/query	200	2.00	13 B	pass
Refuse a query with an unknown group	POST /v1/metrics/query	400	2.00	88 B	pass
Read the metrics settings	GET /v1/metrics/settings	200	2.00	292 B	pass
Answer 404 for the scrape endpoint while OpenMetrics is off	GET /metrics	404	2.00	21 B	pass
Summarize usage over a valid window	GET /v1/usage/summary?from=0&to=1000	200	3.00	231 B	pass
Refuse a usage window that ends before it starts	GET /v1/usage/summary?from=2000&to=1000	400	3.00	42 B	pass
List the model prices	GET /v1/prices	200	6.00	488.7 KiB	pass
Answer 404 for a model with no price	GET /v1/prices/no-such-model-xyz	404	5.00	42 B	pass

joining17 requests

Request	Call	Status	ms	Size	Result
List the node join codes on an empty hub	GET /v1/nodes/codes	200	4.00	2 B	pass
Issue a join code for a new node	POST /v1/nodes/codes	201	5.00	221 B	pass
List the join codes shows the new code as active	GET /v1/nodes/codes	200	2.00	120 B	pass
Revoke an unused node join code	DELETE /v1/nodes/codes/c1	200	3.00	26 B	pass
List the join codes after revoking shows the code as revoked	GET /v1/nodes/codes	200	3.00	121 B	pass
Answer 404 when revoking an unknown node join code	DELETE /v1/nodes/codes/c999999	404	1.00	24 B	pass
Answer 400 when the node join code body is not JSON	POST /v1/nodes/codes	400	2.00	111 B	pass
Refuse a node join with a bad join code	POST /v1/nodes/join	403	3.00	39 B	pass
List the workstation join codes on an empty hub	GET /v1/stations/codes	200	2.00	2 B	pass
Answer 400 when the workstation join code body is not JSON	POST /v1/stations/codes	400	4.00	111 B	pass
Answer 404 when revoking an unknown workstation join code	DELETE /v1/stations/codes/c999999	404	2.00	24 B	pass
Refuse a workstation join with a bad join code	POST /v1/stations/join	403	3.00	95 B	pass
Answer 404 when stopping an unknown node	POST /v1/nodes/n999/stop	404	5.00	24 B	pass
Answer 404 when resuming an unknown node	POST /v1/nodes/n999/resume	404	2.00	24 B	pass
Stopping the hub's own node n0 takes it out of service	POST /v1/nodes/n0/stop	200	3.00	310 B	pass
Resuming the hub's own node n0 puts it back in service	POST /v1/nodes/n0/resume	200	4.00	310 B	pass
A dry-run rebalance lists its moves and starts none	POST /v1/nodes/rebalance	200	3.00	28 B	pass

agents13 requests

Request	Call	Status	ms	Size	Result
List the agents on a hub with no node	GET /v1/agents	200	2.00	2 B	pass
Answer 404 for an agent that does not exist	GET /v1/agents/999999	404	4.00	25 B	pass
Answer 400 for an agent id that is not a number	GET /v1/agents/not-a-number	400	4.00	32 B	pass
Answer 404 when deleting an agent that does not exist	DELETE /v1/agents/999999	404	3.00	25 B	pass
List the roles before any custom role exists	GET /v1/roles	200	3.00	52.0 KiB	pass
Refuse a custom role with missing fields	POST /v1/roles	400	4.00	62 B	pass
Create a custom role	POST /v1/roles	200	3.00	278 B	pass
Read the custom role back from the list	GET /v1/roles	200	14.0	52.4 KiB	pass
Change a custom role by saving it again	POST /v1/roles	200	2.00	322 B	pass
Delete a custom role	DELETE /v1/roles/scout-test	200	3.00	34 B	pass
Answer 404 when deleting a role that is already gone	DELETE /v1/roles/scout-test	404	3.00	30 B	pass
List the bench on a hub with no node	GET /v1/agents?project=bench	200	3.00	2 B	pass
Answer 404 for an unknown project's roster	GET /v1/agents?project=no-such-project	404	3.00	38 B	pass

governance11 requests

Request	Call	Status	ms	Size	Result
List the approvals on an empty hub	GET /v1/approvals	200	2.00	2 B	pass
Read an agent's permission mode before any change	GET /v1/agents/7/permissions	200	2.00	40 B	pass
Set an agent's permission mode to read_only	PUT /v1/agents/7/permissions	200	44.0	20 B	pass
Read back the permission mode after the change	GET /v1/agents/7/permissions	200	4.00	37 B	pass
Refuse a permission mode that is not one of the three	PUT /v1/agents/7/permissions	400	4.00	77 B	pass
Decide an approval that does not exist	POST /v1/approvals/no-such-approval	404	2.00	28 B	pass
List the sanctions on an empty hub	GET /v1/sanctions	200	2.00	33 B	pass
Lift a sanction that does not exist	POST /v1/sanctions/999999/lift	404	1.00	30 B	pass
Refuse a default decision model without a provider and model	PUT /v1/decisions/default	400	1.00	68 B	pass
List the agent proposals on an empty hub	GET /v1/agent-proposals	200	3.00	2 B	pass
Approve an agent proposal that does not exist	POST /v1/agent-proposals/no-such-proposal/approve	409	2.00	40 B	pass

foundry9 requests

Request	Call	Status	ms	Size	Result
List the datasets (empty on a fresh hub)	GET /v1/foundry/datasets	200	1.00	2 B	pass
List the jobs (empty on a fresh hub)	GET /v1/foundry/jobs	200	2.00	2 B	pass
Get a job that does not exist	GET /v1/foundry/jobs/no-such-job	404	2.00	23 B	pass
List the events of a job that does not exist	GET /v1/foundry/jobs/no-such-job/events?after=0	404	4.00	23 B	pass
Export a dataset from a body that is not JSON	POST /v1/foundry/datasets	400	3.00	58 B	pass
Upload a dataset with no file named	POST /v1/foundry/datasets/upload	400	3.00	41 B	pass
List the IDE's workspaces (only project repos on a fresh hub)	GET /v1/ide/workspaces	200	3.00	337 B	pass
Read the checkpoints of a workspace that does not exist	GET /v1/ide/workspaces/repo:no-such-repo@main/checkpoints	404	2.00	47 B	pass
Read the checkpoints of a malformed workspace id	GET /v1/ide/workspaces/not-a-workspace/checkpoints	400	2.00	66 B	pass

e2b8 requests

Request	Call	Status	ms	Size	Result
Create an E2B key for the reads	POST /v1/e2b/keys	200	23.0	131 B	pass
List the running sandboxes (empty)	GET /e2b/sandboxes	200	1.00	2 B	pass
List the sandboxes by state (empty)	GET /e2b/v2/sandboxes?state=running,paused	200	2.00	2 B	pass
List every sandbox for the owner's console (empty)	GET /v1/e2b/sandboxes	200	1.00	16 B	pass
Get a sandbox that does not exist	GET /e2b/sandboxes/sb0000000000000000	404	3.00	87 B	pass
Refuse the sandbox list without an E2B key	GET /e2b/sandboxes	401	3.00	92 B	pass
List the templates and their builds (empty)	GET /v1/e2b/templates	200	2.00	16 B	pass
Revoke the E2B key	DELETE /v1/e2b/keys/e2k-7a63f0a8686e	200	23.0	11 B	pass

conversations15 requests

Request	Call	Status	ms	Size	Result
List the owner's conversations on a hub with none	GET /v1/owner/conversations	200	2.00	2 B	pass
Refuse a conversation while no orchestrator is connected	POST /v1/owner/conversations	409	1.00	118 B	pass
Refuse a conversation with no text	POST /v1/owner/conversations	400	1.00	34 B	pass
Refuse a conversation with an empty message	POST /v1/owner/conversations	400	2.00	34 B	pass
Answer 404 for an unknown conversation	GET /v1/owner/conversations/conv-999	404	2.00	32 B	pass
Answer 404 for a message to an unknown conversation	POST /v1/owner/conversations/conv-999/messages	404	2.00	36 B	pass
Answer 404 when renaming an unknown conversation	PATCH /v1/owner/conversations/conv-999	404	1.00	36 B	pass
Refuse an empty title	PATCH /v1/owner/conversations/conv-999	400	1.00	37 B	pass
Answer 404 for an unknown conversation's transcript	GET /v1/owner/conversations/conv-999/transcript	404	2.00	32 B	pass
List the conversations with the archived ones	GET /v1/owner/conversations?archived=true	200	1.00	2 B	pass
Answer 404 for an unknown conversation's draft	GET /v1/owner/conversations/conv-999/draft	404	2.00	32 B	pass
Answer 404 when editing an unknown conversation's draft	PATCH /v1/owner/conversations/conv-999/draft	404	2.00	32 B	pass
Refuse a draft edit with a field drafts do not have	PATCH /v1/owner/conversations/conv-999/draft	400	5.00	162 B	pass
Answer 404 when starting an unknown conversation's project	POST /v1/owner/conversations/conv-999/start	404	2.00	36 B	pass
Refuse a start that names no revision	POST /v1/owner/conversations/conv-999/start	400	2.00	65 B	pass

weft7 requests

Request	Call	Status	ms	Size	Result
Show whether Weft is running on a fresh hub	GET /v1/weft	200	3.00	46 B	pass
List the Weft repositories on a fresh hub	GET /v1/weft/repos	200	3.00	361 B	pass
List the language packs Weft has loaded	GET /v1/weft/packs	200	2.00	318 B	pass
List the Weft keys, with the owner's on a fresh hub	GET /v1/weft/keys	200	5.00	634 B	pass
List the Weft operations log, newest first	GET /v1/weft/ops?limit=20	200	2.00	741 B	pass
List the review recipes and the proposals waiting	GET /v1/recipes	200	5.00	556 B	pass
Show the code review recipe as its TOML	GET /v1/recipes/code	200	2.00	6.0 KiB	pass

platforms4 requests

Request	Call	Status	ms	Size	Result
List the git platforms on a fresh hub	GET /v1/platforms	200	4.00	323 B	pass
Start creating the GitHub App	POST /v1/platforms/github/app	200	1.00	129 B	pass
A callback with an unknown state does nothing	GET /v1/platforms/callback?code=x&state=unknown	400	1.00	501 B	pass
An organisation-level token must name its organisation	POST /v1/platforms/tokens	400	2.00	71 B	pass

projects-life16 requests

Request	Call	Status	ms	Size	Result
List the project modes	GET /v1/project-modes	200	2.00	371 B	pass
Bring in a finished project from a git address	POST /v1/projects/adopt	201	40.0	1.4 KiB	pass
Put the project back in build	POST /v1/projects/pr3/mode	200	3.00	988 B	pass
Answer 400 for a mode that does not exist	POST /v1/projects/pr3/mode	400	1.00	35 B	pass
Get the maintenance view of a fresh project	GET /v1/projects/pr3/maintenance	200	2.00	357 B	pass
Add a signal to the project's inbox	POST /v1/projects/pr3/maintenance/signals	201	2.00	183 B	pass
Make the project's ingest address	POST /v1/projects/pr3/maintenance/ingest	201	2.00	139 B	pass
Send a signal to the ingest address without a token	POST /v1/ingest/apzi_99dd5ec804ae9f44ae45c6d033b669f3cc29d6f6f2903694	202	2.00	11 B	pass
Answer 404 for an ingest address that does not exist	POST /v1/ingest/apzi_not-a-real-address	404	1.00	34 B	pass
Answer 404 when approving a proposal that does not exist	POST /v1/projects/pr3/maintenance/proposals/mp999/approve	404	1.00	28 B	pass
List the project's environments	GET /v1/projects/pr3/environments	200	1.00	247 B	pass
Put a staging environment that tracks main	PUT /v1/projects/pr3/environments/staging	200	6.00	239 B	pass
Deploy a named version to staging	POST /v1/projects/pr3/environments/staging/deploy	200	3.00	96 B	pass
Put a secret for the staging environment	PUT /v1/projects/pr3/environments/staging/secrets/STAGING_DEPLOY_TOKEN	200	62.0	63 B	pass
Upload a file's bytes into the project	PUT /v1/projects/pr3/uploads	201	23.0	85 B	pass
Land the uploaded file on main as one change	POST /v1/projects/pr3/files	200	63.0	109 B	pass

Timings

Every GET in the spec without path parameters, requested 20 times in a row on the CI runner, slowest p95 first. Times are milliseconds on a shared runner: compare them run to run, not to production. The last column is the p95's change against main.

Route	What it does	Status	p50	p95	max	Size	vs main
/v1/overview	Read the hub's overview	200	5.45	70.2	70.2	224 B	-28%
/v1/e2b/keys	List the E2B API keys	200	2.51	28.7	28.7	11 B	+1424%
/v1/connectors	List the connectors and their settings	200	2.99	25.0	25.0	11.6 KiB	+109%
/v1/prices	List the model prices	200	8.25	23.1	23.1	488.7 KiB	+174%
/v1/metrics/catalog	Read the metric catalog	200	3.07	18.3	18.3	28.4 KiB	+1063%
/v1/acp	Open an editor's ACP socket	409	2.55	17.9	17.9	104 B	+199%
/v1/platforms/callback	Take the browser back from a platform	400	4.60	17.9	17.9	501 B	new
/v1/foundry/models	List the foundry's models	200	2.11	16.1	16.1	13 B	+355%
/v1/metrics/view	Compose a metrics view	200	6.94	15.1	15.1	3.7 KiB	+78%
/v1/ide/workspaces	List the IDE's workspaces	200	6.17	14.2	14.2	511 B	+330%
/v1/treasury/series	Show the treasury over time	200	4.32	14.2	14.2	9.9 KiB	+232%
/v1/society	Show the society: agents, bonds and reputations	200	3.04	14.2	14.2	52 B	+41%
/v1/providers	List the providers	200	3.48	14.0	14.0	4.4 KiB	+108%
/v1/treasury/journal	List the treasury journal	200	3.87	13.9	13.9	2.3 KiB	+58%
/v1/nodes/codes	List the join codes	200	3.20	13.7	13.7	121 B	+615%
/v1/approvals	List the approvals, pending and decided	200	3.39	13.0	13.0	2 B	+665%
/v1/files	List the files agents handed in	200	2.39	12.6	12.6	2 B	+90%
/v1/mcp/catalog	List the MCP server presets	200	2.89	11.5	11.5	4.2 KiB	+472%
/v1/sanctions	List the sanctions and suspensions	200	4.82	10.8	10.8	33 B	+327%
/v1/metrics/export	Export a view as CSV	200	4.97	10.1	10.1	24 B	+95%
/v1/prompts	List the prompts	200	3.36	10.1	10.1	5.3 KiB	+380%
/v1/prompts/rules	List the prompt rules and templates	200	3.25	10.1	10.1	5.5 KiB	+381%
/v1/decisions/default	Get the default decision model	200	2.69	9.76	9.76	30 B	+60%
/v1/metrics/forecast	Show the capacity forecast	200	5.26	9.57	9.57	187 B	+138%
/v1/hub/identity	Show the hub's identity	200	3.77	9.26	9.26	99 B	+258%
/v1/metrics/around	Show what changed around a time	200	3.88	9.03	9.03	202 B	+61%
/v1/node-link	Read this machine's link to a hub	200	3.59	9.03	9.03	81 B	+293%
/v1/weft	Show whether Weft, the plaza's version control, is running	200	4.77	8.95	8.95	46 B	new
/v1/vault	Show the vault's state	200	2.60	8.82	8.82	245 B	+350%
/v1/agora	Show the agora's calls	200	3.23	8.47	8.47	52 B	+133%
/v1/laws	List the laws and how often each refused a call	200	4.21	8.44	8.44	102.5 KiB	+48%
/v1/metrics/scopes	List the metric scopes	200	3.89	8.43	8.43	6.3 KiB	+142%
/v1/machines	List the machines on this plaza	200	4.13	8.31	8.31	58 B	+12%
/v1/board	Read the board	200	2.86	8.22	8.22	134 B	-4%
/v1/templates	List the warm templates	502	3.31	7.97	7.97	101 B	+5%
/v1/volumes	List the data volumes	502	3.62	7.94	7.94	101 B	+60%
/v1/egress/inject	List the egress injection rules	200	2.59	7.88	7.88	12 B	+405%
/v1/skills/export	Export several skills as one zip	422	2.84	7.87	7.87	24 B	+185%
/v1/owner/conversations	List the owner's conversations with the orchestrator	200	3.29	7.81	7.81	2 B	new
/v1/tasks	List the tasks	200	3.99	7.64	7.64	985 B	+57%
/v1/vault/secrets	List the vault's entries	200	4.00	7.55	7.55	1.1 KiB	+310%
/v1/fleet	List the machines and the agents on them	200	3.07	7.54	7.54	295 B	+240%
/v1/usage/calls	List the newest model calls	200	2.27	7.40	7.40	41 B	+172%
/v1/vault/consumers	List each consumer and its resolved entry	200	3.64	7.39	7.39	4.0 KiB	+177%
/v1/machine	Read this machine's facts	502	2.91	7.08	7.08	101 B	-14%
/v1/loops	List the scheduled loops	200	2.96	6.83	6.83	2 B	+121%
/v1/mcp/servers	List the MCP servers	200	2.66	6.68	6.68	2 B	+118%
/v1/connectors/proposals	List connector proposals, newest first	200	3.04	6.66	6.66	2 B	+256%
/v1/metrics/events	List the metric events	200	2.45	6.66	6.66	2 B	+314%
/v1/nodes	List the plaza's machines	200	2.43	6.64	6.64	312 B	+183%
/v1/foundry/jobs	List the jobs, newest first	200	2.88	6.62	6.62	2 B	+77%
/v1/stations/recording-defaults	Show the recording defaults for new workstations	200	1.90	6.52	6.52	74 B	+504%
/v1/platforms	List the git platforms the plaza is authorized on	200	3.83	6.39	6.39	323 B	new
/v1/laws/violations	List the recorded refusals of a law	200	2.09	6.29	6.29	2 B	+286%
/v1/projects	List the projects	200	2.22	6.26	6.26	2.7 KiB	+71%
/v1/runs	List the runs on this machine	502	3.15	6.23	6.23	101 B	-62%
/v1/foundry/recipes	List the recipes	200	3.73	6.23	6.23	541 B	-26%
/v1/hub	Read the hub's status	502	2.40	6.16	6.16	101 B	-11%
/v1/roles	List the built-in and custom roles	200	2.92	6.09	6.09	52.0 KiB	-31%
/v1/metrics/alerts	List the alerts and their state	200	3.10	6.00	6.00	2.3 KiB	+38%
/v1/foundry/datasets	List the datasets	200	3.13	5.97	5.97	2 B	+176%
/v1/auth/check	Check that the session is signed in	200	2.25	5.90	5.90	11 B	+159%
/v1/stations/codes	List the join codes	200	2.43	5.81	5.81	2 B	+123%
/v1/conversations	List the conversations	200	3.08	5.67	5.67	147 B	+70%
/v1/project-modes	List the modes a project can be in	200	3.33	5.64	5.64	371 B	new
/v1/hub-mcp/calls	List the recent MCP calls	200	1.89	5.63	5.63	12 B	+33%
/v1/metrics/slos	List the service-level objectives	200	3.35	5.57	5.57	785 B	+65%
/v1/stations/link	Open the workstation daemon's link socket	401	2.29	5.52	5.52	61 B	+309%
/v1/skills/rules	List the skill rules and the template	200	3.32	5.37	5.37	2.3 KiB	+103%
/v1/recipes	List the review recipes and the orchestrator's proposals	200	2.56	5.36	5.36	556 B	new
/v1/toolbox	List the toolbox discoveries	200	2.67	5.26	5.26	2 B	+107%
/v1/stations/recordings	List the station recordings, newest first	200	1.67	4.95	4.95	2 B	+350%
/v1/treasury	Show the treasury balances	200	3.14	4.82	4.82	759 B	+26%
/v1/hub-mcp/tokens	List the MCP tokens	200	1.90	4.75	4.75	192 B	+63%
/v1/stations/vms	List the workstation VMs	200	2.90	4.72	4.72	2 B	+223%
/v1/e2b/sandboxes	List all sandboxes for the owner's console	200	2.11	4.69	4.69	16 B	+168%
/v1/metrics/settings	Read the metrics settings	200	1.66	4.44	4.44	292 B	+172%
/v1/metrics/dashboards	Read the saved dashboards	200	1.74	4.39	4.39	50 B	+388%
/v1/settings	Get the hub's settings	200	2.14	4.37	4.37	1.3 KiB	-23%
/v1/skills	List the skills, or the archived ones	200	2.91	4.37	4.37	13 B	+244%
/v1/infractions	List the recent infractions	200	2.40	4.32	4.32	2 B	+50%
/v1/motions	List the motions	200	3.32	4.30	4.30	214 B	-29%
/v1/agents	List the agents	200	1.96	4.29	4.29	2 B	+22%
/v1/foundry/devices	List the accelerators and the jobs holding them	200	2.11	4.23	4.23	15 B	-3%
/v1/acp/sessions	List the editor (ACP) sessions	200	2.53	4.15	4.15	2 B	-34%
/v1/robots/species	List the robot species with counts	200	2.24	4.10	4.10	1.2 KiB	-20%
/v1/foundry/hf/imports	List the Hugging Face imports	200	2.82	4.07	4.07	14 B	+18%
/v1/stations/audit	List the station audit, newest first	200	1.40	4.03	4.03	2 B	+217%
/v1/library	List the library's tool versions	200	1.84	3.94	3.94	2 B	+41%
/v1/plaza/state	Show whether the plaza is stopped	200	1.91	3.89	3.89	63 B	+132%
/v1/metrics/calls/page	Load the next page of calls	200	2.14	3.55	3.55	351 B	+26%
/v1/treasury/wallets	List the agent wallets	200	2.19	3.54	3.54	2 B	+23%
/v1/agent-proposals	List the agent proposals	200	1.78	3.48	3.48	2 B	+225%
/v1/metrics/calls	List the agents' calls	200	2.22	3.44	3.44	2 B	+5%
/v1/board/export	Export a board thread as Markdown or JSON	200	2.74	3.35	3.35	69 B	+18%
/v1/usage/summary	Summarize usage over a time window	200	1.34	3.35	3.35	252 B	-51%
/v1/ws	Open a socket that streams the hub's events	400	2.42	3.24	3.24	79 B	-49%
/v1/foundry/hf/status	Show the Hugging Face status	200	2.57	3.22	3.22	116 B	-34%
/v1/stations	List the workstations	200	1.85	3.19	3.19	2 B	+175%
/v1/e2b/templates	List the templates and their builds	200	1.75	3.01	3.01	16 B	+87%
/v1/metrics	Scrape the hub's Prometheus metrics	200	1.97	2.99	2.99	5.1 KiB	+56%
/v1/provider-kinds	List the provider kinds you can add	200	1.94	2.79	2.79	8.3 KiB	-73%
/v1/ide/audit	List the IDE's audit log	200	2.00	2.75	2.75	2 B	-56%
/v1/vault/audit	Read the audit log, verifying it on request	200	2.05	2.72	2.72	1.6 KiB	+39%
/v1/usage/series	Show usage over time, bucketed	200	1.90	2.54	2.54	28.0 KiB	-7%
/v1/hub-mcp	Show the hub's MCP server status	200	1.41	2.22	2.22	278 B	-29%
/v1/laws/rules	List the owner's rules and overrides	200	1.94	2.22	2.22	87 B	+19%
/v1/metrics/traces	List the kept traces	200	1.53	2.08	2.08	2 B	+27%

Fuzzing (Schemathesis)

Requests generated from docs/api/openapi.json: a 5xx answer or a connection dropped without an answer is a finding. 502 and 503 come from the scratch hub's missing node daemon and git host. Reported here; findings do not fail the pull request yet.

Server error16

Operation	What happened
POST /v1/agent-proposals/{id}/reject	1. Test Case ID: Kd37iZ - Server error [502] Bad Gateway: `{"error":"no node 0"}` Reproduce with: curl -X POST http://127.0.0.1:17777/v1/nodes/0/runs
POST /v1/nodes/{id}/stop	1. Test Case ID: iXH1PT - Server error [502] Bad Gateway: `{"error":"127.0.0.1:1 unreachable: cannot connect to 127.0.0.1:1: Connection refused (os error 111)"}` Reproduce with: curl -X POST http://127.0.0.1:17777/v1/runs
POST /v1/runs/{id}/input	1. Test Case ID: nTcMJC - Server error [502] Bad Gateway: `{"error":"127.0.0.1:1 unreachable: cannot connect to 127.0.0.1:1: Connection refused (os error 111)"}` Reproduce with: curl -X POST http://127.0.0.1:17777/v1/runs/0/input
POST /v1/sanctions/{id}/lift	1. Test Case ID: ybL1f4 - Server error [502] Bad Gateway: `{"error":"127.0.0.1:1 unreachable: cannot connect to 127.0.0.1:1: Connection refused (os error 111)"}` Reproduce with: curl -X POST http://127.0.0.1:17777/v1/volumes
PUT /v1/decisions/default	1. Test Case ID: j2D64f - Server error [502] Bad Gateway: `{"error":"127.0.0.1:2 unreachable: cannot connect to 127.0.0.1:2: Connection refused (os error 111)"}` Reproduce with: curl -X GET http://127.0.0.1:17777/v1/hub
GET /v1/hub-mcp/calls	1. Test Case ID: 2N6WAE - Server error [502] Bad Gateway: `{"error":"127.0.0.1:1 unreachable: cannot connect to 127.0.0.1:1: Connection refused (os error 111)"}` Reproduce with: curl -X GET http://127.0.0.1:17777/v1/machine
GET /v1/mcp/catalog	1. Test Case ID: JCSrz4 - Server error [502] Bad Gateway: `{"error":"no node 0"}` Reproduce with: curl -X GET http://127.0.0.1:17777/v1/nodes/0/machine
GET /v1/nodes/{id}/runs	1. Test Case ID: w7NPYF - Server error [502] Bad Gateway: `{"error":"no node 0"}` Reproduce with: curl -X GET http://127.0.0.1:17777/v1/nodes/0/runs
GET /v1/nodes/{id}/stats	1. Test Case ID: GUFtYz - Server error [502] Bad Gateway: `{"error":"no node 0"}` Reproduce with: curl -X GET http://127.0.0.1:17777/v1/nodes/0/stats
GET /v1/nodes/{id}/commands	1. Test Case ID: vKST0y - Server error [502] Bad Gateway: `{"error":"127.0.0.1:1 unreachable: cannot connect to 127.0.0.1:1: Connection refused (os error 111)"}` Reproduce with: curl -X GET http://127.0.0.1:17777/v1/runs
GET /v1/runs/{id}	1. Test Case ID: MlnHKh - Server error [502] Bad Gateway: `{"error":"127.0.0.1:1 unreachable: cannot connect to 127.0.0.1:1: Connection refused (os error 111)"}` Reproduce with: curl -X GET http://127.0.0.1:17777/v1/runs/0
GET /v1/sanctions	1. Test Case ID: 36UIdy - Server error [502] Bad Gateway: `{"error":"127.0.0.1:1 unreachable: cannot connect to 127.0.0.1:1: Connection refused (os error 111)"}` Reproduce with: curl -X GET http://127.0.0.1:17777/v1/templates
GET /v1/toolbox	1. Test Case ID: fKqijl - Server error [502] Bad Gateway: `{"error":"127.0.0.1:1 unreachable: cannot connect to 127.0.0.1:1: Connection refused (os error 111)"}` Reproduce with: curl -X GET http://127.0.0.1:17777/v1/volumes
PATCH /v1/mcp/servers/{id}	1. Test Case ID: 8CDrwi - Server error [502] Bad Gateway: `{"error":"127.0.0.1:1 unreachable: cannot connect to 127.0.0.1:1: Connection refused (os error 111)"}` Reproduce with: curl -X DELETE http://127.0.0.1:17777/v1/runs/0
DELETE /v1/stations/codes/{id}	1. Test Case ID: rqsPxZ - Server error [502] Bad Gateway: `{"error":"127.0.0.1:1 unreachable: cannot connect to 127.0.0.1:1: Connection refused (os error 111)"}` Reproduce with: curl -X DELETE http://127.0.0.1:17777/v1/templates/0
DELETE /v1/stations/{id}/files/{path}	1. Test Case ID: h1wKGT - Server error [502] Bad Gateway: `{"error":"127.0.0.1:1 unreachable: cannot connect to 127.0.0.1:1: Connection refused (os error 111)"}` Reproduce with: curl -X DELETE http://127.0.0.1:17777/v1/volumes/0

Coverage by area

Area	Tested
e2b	7/39
projects	29/38
stations	5/38
internal	0/37
agents	5/34
foundry	6/33
metrics	5/27
skills	5/23
nodes	7/18
vault	5/17
platforms	4/17
ide	2/15
prompts	5/15
mcp	5/13
tasks	6/11
laws	4/10
owner	9/9
providers	5/8
board	2/7
connectors	0/7
treasury	0/6
hub-mcp	3/6
runs	0/5
motions	0/5
files	0/5
library	4/4
weft	2/4
recipes	2/4
egress	0/4
hub	1/3
volumes	0/3
decisions	1/3
toolbox	0/3
loops	0/3
plaza	0/3
roles	3/3
agent-proposals	2/3
prices	2/3
usage	1/3
node-link	0/3
auth	2/3
console	1/3
templates	0/2
acp	0/2
settings	2/2
conversations	0/2
approvals	2/2
sanctions	2/2
reviews	0/2
unfurl	0/2
overview	1/1
machines	0/1
machine	0/1
ws	0/1
provider-kinds	0/1
models	0/1
agora	0/1
society	0/1
project-modes	1/1
ingest	1/1
infractions	0/1
fleet	0/1
robots	0/1

Made by api-tests/run.sh in the pull request gate. Bodies are scrubbed of tokens and secrets before they are published.