Hub API report

Pull request #62 · commit 84a68de9ed · 2026-10-20 12:54 UTC · the CI run

All API tests pass

Requests

244/244

Bruno requests passing

Checks

859/859

assertions and tests

Spec coverage

158/575

operations the tests call (27%)

p95, median route

7.34 ms

114 GET routes × 20

Slowest p95

96.1 ms

/v1/overview

Fuzzing findings

17 server error

API tests (Bruno)

The collection in api-tests/bruno, run against a scratch hub: no database, no node daemon, no git host. A failing request fails the pull request.

hub3 requests

Request	Call	Status	ms	Size	Result
Read the hub's identity	GET /v1/hub/identity	200	11.0	99 B	pass
Read the hub's overview	GET /v1/overview	200	4.00	202 B	pass
Answer 404 for an unknown endpoint	GET /v1/no-such-endpoint	404	6.00	28 B	pass

skills8 requests

Request	Call	Status	ms	Size	Result
List skills on a fresh hub (only the built-in ones)	GET /v1/skills	200	4.00	556 B	pass
Create a skill	POST /v1/skills	201	38.0	358 B	pass
Read the skill back	GET /v1/skills/pdf-forms	200	2.00	657 B	pass
Change a skill's title and tags	PUT /v1/skills/pdf-forms	200	38.0	374 B	pass
List skills after the change	GET /v1/skills	200	37.0	921 B	pass
Archive a skill	POST /v1/skills/pdf-forms/archive	200	28.0	383 B	pass
Answer 404 for an unknown skill	GET /v1/skills/no-such-skill	404	4.00	36 B	pass
Refuse a create without a title	POST /v1/skills	400	5.00	53 B	pass

prompts8 requests

Request	Call	Status	ms	Size	Result
List the built-in prompts	GET /v1/prompts	200	4.00	5.3 KiB	pass
Create a system prompt	POST /v1/prompts	201	18.0	282 B	pass
Read the created prompt back	GET /v1/prompts/planner	200	3.00	525 B	pass
Edit the prompt's details	PUT /v1/prompts/planner	200	15.0	291 B	pass
List the prompts after the edit	GET /v1/prompts	200	1.00	5.5 KiB	pass
Archive the prompt	POST /v1/prompts/planner/archive	200	27.0	300 B	pass
Answer 404 for an unknown prompt id	GET /v1/prompts/no-such-prompt	404	1.00	37 B	pass
Reject a create body without a title	POST /v1/prompts	400	3.00	53 B	pass

rules8 requests

Request	Call	Status	ms	Size	Result
List the owner's rules on an empty hub	GET /v1/laws/rules	200	2.00	87 B	pass
Add a rule	POST /v1/laws/rules	201	5.00	325 B	pass
List the rules after adding one	GET /v1/laws/rules	200	2.00	412 B	pass
Rename a rule	PUT /v1/laws/rules/R-001	200	6.00	334 B	pass
List the rules after a rename	GET /v1/laws/rules	200	3.00	421 B	pass
Delete a rule	DELETE /v1/laws/rules/R-001	200	4.00	19 B	pass
Answer 404 for an unknown rule	DELETE /v1/laws/rules/no-such-rule	404	1.00	40 B	pass
Refuse a rule whose body is not a JSON object	POST /v1/laws/rules	400	2.00	42 B	pass

providers8 requests

Request	Call	Status	ms	Size	Result
List the providers	GET /v1/providers	200	2.00	6.3 KiB	pass
Add a provider	POST /v1/providers	201	16.0	333 B	pass
Read the provider back	GET /v1/providers/scratch-provider	200	2.00	333 B	pass
Replace the provider's settings	PUT /v1/providers/scratch-provider	200	16.0	333 B	pass
List the providers again	GET /v1/providers	200	2.00	6.6 KiB	pass
Delete the provider	DELETE /v1/providers/scratch-provider	200	12.0	30 B	pass
Answer 404 for an unknown provider	GET /v1/providers/no-such-provider	404	1.00	42 B	pass
Refuse a provider body that does not parse	POST /v1/providers	400	1.00	85 B	pass

vault8 requests

Request	Call	Status	ms	Size	Result
Show the vault's state	GET /v1/vault	200	1.00	245 B	pass
List the vault's entries before any secret of the owner's	GET /v1/vault/secrets	200	2.00	695 B	pass
Create a secret	POST /v1/vault/secrets	200	37.0	333 B	pass
Change a secret's label	PATCH /v1/vault/secrets/sec_5dq37pc55d7u	200	17.0	342 B	pass
Read the secret's metadata back from the list	GET /v1/vault/secrets	200	1.00	1.0 KiB	pass
Delete a secret	DELETE /v1/vault/secrets/sec_5dq37pc55d7u	204	44.0	0 B	pass
Answer 404 for an unknown secret id	DELETE /v1/vault/secrets/sec_doesnotexist	404	2.00	26 B	pass
Refuse a secret body without a value	POST /v1/vault/secrets	400	2.00	53 B	pass

settings7 requests

Request	Call	Status	ms	Size	Result
Read the hub's settings	GET /v1/settings	200	2.00	1.3 KiB	pass
Save a valid change to the settings	PUT /v1/settings	200	2.00	1.3 KiB	pass
Refuse a settings value out of range	PUT /v1/settings	400	2.00	44 B	pass
Refuse a settings body that is not valid JSON for the type	PUT /v1/settings	400	2.00	94 B	pass
Read the saved change back	GET /v1/settings	200	2.00	1.3 KiB	pass
Check the session is signed in	GET /v1/auth/check	200	1.00	11 B	pass
Refuse a sign-in with a wrong owner token	POST /v1/auth/session	401	1.00	39 B	pass

plaza20 requests

Request	Call	Status	ms	Size	Result
List the tasks on an empty hub	GET /v1/tasks	200	1.00	12 B	pass
Open a project for the tasks	POST /v1/projects	201	24.0	674 B	pass
Create a task	POST /v1/tasks	201	2.00	346 B	pass
Read the task back	GET /v1/tasks/t1	200	7.00	346 B	pass
List the tasks after a create	GET /v1/tasks	200	2.00	358 B	pass
Withdraw an open task	DELETE /v1/tasks/t1	200	1.00	359 B	pass
Answer 404 for an unknown task	GET /v1/tasks/t999999	404	1.00	35 B	pass
Refuse a task with no goal	POST /v1/tasks	400	1.00	75 B	pass
Read the board	GET /v1/board	200	1.00	134 B	pass
Refuse a board post from an unknown agent	POST /v1/board	404	1.00	37 B	pass
Refuse a board post with an empty subject	POST /v1/board	400	1.00	37 B	pass
Create a task others will run after	POST /v1/tasks	201	1.00	301 B	pass
Create a task that runs after another	POST /v1/tasks	201	2.00	320 B	pass
List only the tasks that can be claimed now	GET /v1/tasks?ready=true	200	1.00	313 B	pass
Refuse a ready filter that is not true or false	GET /v1/tasks?ready=maybe	400	1.00	54 B	pass
Refuse links that would close a cycle	PATCH /v1/tasks/t2	400	2.00	80 B	pass
Relink an open task	PATCH /v1/tasks/t3	200	3.00	311 B	pass
Answer 404 for relinking an unknown task	PATCH /v1/tasks/t999999	404	1.00	35 B	pass
Refuse a task outside a project	POST /v1/tasks	400	1.00	93 B	pass
Refuse a task for an unknown project	POST /v1/tasks	404	2.00	38 B	pass

library40 requests

Request	Call	Status	ms	Size	Result
List the library's tool versions	GET /v1/library	200	3.00	2 B	pass
Answer 404 for files of an unknown tool version	GET /v1/library/no-such-tool/1/files	404	2.00	27 B	pass
Answer 409 when reviewing an unknown tool version	POST /v1/library/no-such-tool/1/review	409	1.00	27 B	pass
Answer 400 when a review has no approve field	POST /v1/library/no-such-tool/1/review	400	1.00	54 B	pass
Answer 404 when deleting an unknown tool version	DELETE /v1/library/no-such-tool/1	404	1.00	27 B	pass
List the projects	GET /v1/projects	200	1.00	939 B	pass
Answer 404 for an unknown project	GET /v1/projects/no-such-project	404	1.00	27 B	pass
Answer 409 when approving an unknown project	POST /v1/projects/no-such-project/approve	409	1.00	44 B	pass
Answer 404 for an unknown project's task graph	GET /v1/projects/no-such-project/graph	404	1.00	27 B	pass
List a project's agents, none yet	GET /v1/projects/pr1/members	200	1.00	2 B	pass
Answer 404 for an unknown project's agents	GET /v1/projects/no-such-project/members	404	1.00	27 B	pass
Refuse to add an agent with no cid	POST /v1/projects/pr1/members	400	2.00	60 B	pass
Answer 404 when adding an unknown agent	POST /v1/projects/pr1/members	404	1.00	25 B	pass
Answer 404 when benching an agent not on the project	DELETE /v1/projects/pr1/members/4242	404	1.00	44 B	pass
Pause a project	POST /v1/projects/pr1/pause	200	2.00	1010 B	pass
Resume a paused project	POST /v1/projects/pr1/resume	200	1.00	1.1 KiB	pass
Refuse a project with no title	POST /v1/projects	400	7.00	45 B	pass
Open a project to archive	POST /v1/projects	201	24.0	634 B	pass
Archive a project	POST /v1/projects/pr2/archive	200	1.00	709 B	pass
Refuse a task for an archived project	POST /v1/tasks	409	1.00	58 B	pass
Refuse to resume an archived project	POST /v1/projects/pr2/resume	409	1.00	35 B	pass
Answer 404 when pausing an unknown project	POST /v1/projects/no-such-project/pause	404	1.00	27 B	pass
Answer 404 when moving an unknown task into a project	POST /v1/tasks/t999/move	404	1.00	32 B	pass
Refuse to move a task out of its project	POST /v1/tasks/t1/move	409	1.00	70 B	pass
Refuse a move that names no project	POST /v1/tasks/t1/move	400	1.00	46 B	pass
Suggest no agents for a project nobody worked on	GET /v1/projects/pr1/suggested-members	200	1.00	2 B	pass
Answer 404 for an unknown project's suggested agents	GET /v1/projects/no-such-project/suggested-members	404	1.00	27 B	pass
Read a project's settings, none set yet	GET /v1/projects/pr1/settings	200	1.00	2 B	pass
Override a project's effort and task budget	PATCH /v1/projects/pr1/settings	200	2.00	36 B	pass
Refuse an effort the plaza does not know	PATCH /v1/projects/pr1/settings	400	1.00	101 B	pass
Refuse a setting projects do not have	PATCH /v1/projects/pr1/settings	400	2.00	209 B	pass
Show where each of a project's settings comes from	GET /v1/projects/pr1/settings/effective	200	1.00	562 B	pass
Set a project's effort back to the plaza's	PATCH /v1/projects/pr1/settings	200	2.00	20 B	pass
Answer 404 for an unknown project's settings	GET /v1/projects/no-such-project/settings	404	1.00	27 B	pass
Read a project's budget, none set aside yet	GET /v1/projects/pr1/budget	200	1.00	55 B	pass
Set credits aside for a project	POST /v1/projects/pr1/budget	200	1.00	57 B	pass
Give some of a project's budget back to the plaza	POST /v1/projects/pr1/budget	200	1.00	56 B	pass
Refuse to move no credits	POST /v1/projects/pr1/budget	400	2.00	28 B	pass
Refuse to give back more than a project has	POST /v1/projects/pr1/budget	409	2.00	102 B	pass
Refuse to set budget aside for an archived project	POST /v1/projects/pr2/budget	409	1.00	66 B	pass

mcp10 requests

Request	Call	Status	ms	Size	Result
List the MCP servers on an empty hub	GET /v1/mcp/servers	200	1.00	2 B	pass
Add an MCP server	POST /v1/mcp/servers	200	1.00	505 B	pass
Read the MCP server back	GET /v1/mcp/servers/test-server	200	1.00	505 B	pass
Change an MCP server's name	PATCH /v1/mcp/servers/test-server	200	1.00	508 B	pass
Answer 404 for an unknown MCP server	GET /v1/mcp/servers/no-such-server	404	2.00	55 B	pass
Refuse an MCP server with an invalid id	POST /v1/mcp/servers	400	1.00	110 B	pass
Delete an MCP server	DELETE /v1/mcp/servers/test-server	204	1.00	0 B	pass
Create an MCP token	POST /v1/hub-mcp/tokens	201	2.00	252 B	pass
List the MCP tokens	GET /v1/hub-mcp/tokens	200	1.00	183 B	pass
Revoke an MCP token	DELETE /v1/hub-mcp/tokens/mcp_664aaa09824a	204	2.00	0 B	pass

metrics11 requests

Request	Call	Status	ms	Size	Result
Read the metric catalog	GET /v1/metrics/catalog	200	3.00	28.4 KiB	pass
Compose the overview view on an empty hub	GET /v1/metrics/view?tab=overview&range=24h	200	3.00	3.7 KiB	pass
Refuse a view with an unknown range	GET /v1/metrics/view?tab=overview&range=2w	400	2.00	75 B	pass
Read a metric series grouped by all	POST /v1/metrics/query	200	3.00	13 B	pass
Refuse a query with an unknown group	POST /v1/metrics/query	400	3.00	88 B	pass
Read the metrics settings	GET /v1/metrics/settings	200	9.00	292 B	pass
Answer 404 for the scrape endpoint while OpenMetrics is off	GET /metrics	404	3.00	21 B	pass
Summarize usage over a valid window	GET /v1/usage/summary?from=0&to=1000	200	7.00	231 B	pass
Refuse a usage window that ends before it starts	GET /v1/usage/summary?from=2000&to=1000	400	5.00	42 B	pass
List the model prices	GET /v1/prices	200	9.00	488.7 KiB	pass
Answer 404 for a model with no price	GET /v1/prices/no-such-model-xyz	404	2.00	42 B	pass

joining17 requests

Request	Call	Status	ms	Size	Result
List the node join codes on an empty hub	GET /v1/nodes/codes	200	17.0	2 B	pass
Issue a join code for a new node	POST /v1/nodes/codes	201	2.00	221 B	pass
List the join codes shows the new code as active	GET /v1/nodes/codes	200	1.00	120 B	pass
Revoke an unused node join code	DELETE /v1/nodes/codes/c1	200	1.00	26 B	pass
List the join codes after revoking shows the code as revoked	GET /v1/nodes/codes	200	4.00	121 B	pass
Answer 404 when revoking an unknown node join code	DELETE /v1/nodes/codes/c999999	404	4.00	24 B	pass
Answer 400 when the node join code body is not JSON	POST /v1/nodes/codes	400	3.00	111 B	pass
Refuse a node join with a bad join code	POST /v1/nodes/join	403	3.00	39 B	pass
List the workstation join codes on an empty hub	GET /v1/stations/codes	200	3.00	2 B	pass
Answer 400 when the workstation join code body is not JSON	POST /v1/stations/codes	400	3.00	111 B	pass
Answer 404 when revoking an unknown workstation join code	DELETE /v1/stations/codes/c999999	404	3.00	24 B	pass
Refuse a workstation join with a bad join code	POST /v1/stations/join	403	3.00	95 B	pass
Answer 404 when stopping an unknown node	POST /v1/nodes/n999/stop	404	2.00	24 B	pass
Answer 404 when resuming an unknown node	POST /v1/nodes/n999/resume	404	4.00	24 B	pass
Stopping the hub's own node n0 takes it out of service	POST /v1/nodes/n0/stop	200	2.00	310 B	pass
Resuming the hub's own node n0 puts it back in service	POST /v1/nodes/n0/resume	200	3.00	310 B	pass
A dry-run rebalance lists its moves and starts none	POST /v1/nodes/rebalance	200	7.00	28 B	pass

agents13 requests

Request	Call	Status	ms	Size	Result
List the agents on a hub with no node	GET /v1/agents	200	4.00	2 B	pass
Answer 404 for an agent that does not exist	GET /v1/agents/999999	404	2.00	25 B	pass
Answer 400 for an agent id that is not a number	GET /v1/agents/not-a-number	400	3.00	32 B	pass
Answer 404 when deleting an agent that does not exist	DELETE /v1/agents/999999	404	2.00	25 B	pass
List the roles before any custom role exists	GET /v1/roles	200	3.00	52.0 KiB	pass
Refuse a custom role with missing fields	POST /v1/roles	400	3.00	62 B	pass
Create a custom role	POST /v1/roles	200	1.00	278 B	pass
Read the custom role back from the list	GET /v1/roles	200	3.00	52.4 KiB	pass
Change a custom role by saving it again	POST /v1/roles	200	3.00	322 B	pass
Delete a custom role	DELETE /v1/roles/scout-test	200	6.00	34 B	pass
Answer 404 when deleting a role that is already gone	DELETE /v1/roles/scout-test	404	4.00	30 B	pass
List the bench on a hub with no node	GET /v1/agents?project=bench	200	4.00	2 B	pass
Answer 404 for an unknown project's roster	GET /v1/agents?project=no-such-project	404	2.00	38 B	pass

governance11 requests

Request	Call	Status	ms	Size	Result
List the approvals on an empty hub	GET /v1/approvals	200	2.00	2 B	pass
Read an agent's permission mode before any change	GET /v1/agents/7/permissions	200	1.00	40 B	pass
Set an agent's permission mode to read_only	PUT /v1/agents/7/permissions	200	34.0	20 B	pass
Read back the permission mode after the change	GET /v1/agents/7/permissions	200	11.0	37 B	pass
Refuse a permission mode that is not one of the three	PUT /v1/agents/7/permissions	400	11.0	77 B	pass
Decide an approval that does not exist	POST /v1/approvals/no-such-approval	404	6.00	28 B	pass
List the sanctions on an empty hub	GET /v1/sanctions	200	3.00	33 B	pass
Lift a sanction that does not exist	POST /v1/sanctions/999999/lift	404	2.00	30 B	pass
Refuse a default decision model without a provider and model	PUT /v1/decisions/default	400	3.00	68 B	pass
List the agent proposals on an empty hub	GET /v1/agent-proposals	200	2.00	2 B	pass
Approve an agent proposal that does not exist	POST /v1/agent-proposals/no-such-proposal/approve	409	2.00	40 B	pass

foundry9 requests

Request	Call	Status	ms	Size	Result
List the datasets (empty on a fresh hub)	GET /v1/foundry/datasets	200	5.00	2 B	pass
List the jobs (empty on a fresh hub)	GET /v1/foundry/jobs	200	2.00	2 B	pass
Get a job that does not exist	GET /v1/foundry/jobs/no-such-job	404	2.00	23 B	pass
List the events of a job that does not exist	GET /v1/foundry/jobs/no-such-job/events?after=0	404	5.00	23 B	pass
Export a dataset from a body that is not JSON	POST /v1/foundry/datasets	400	2.00	58 B	pass
Upload a dataset with no file named	POST /v1/foundry/datasets/upload	400	3.00	41 B	pass
List the IDE's workspaces (only project repos on a fresh hub)	GET /v1/ide/workspaces	200	4.00	337 B	pass
Read the checkpoints of a workspace that does not exist	GET /v1/ide/workspaces/repo:no-such-repo@main/checkpoints	404	4.00	47 B	pass
Read the checkpoints of a malformed workspace id	GET /v1/ide/workspaces/not-a-workspace/checkpoints	400	3.00	66 B	pass

e2b8 requests

Request	Call	Status	ms	Size	Result
Create an E2B key for the reads	POST /v1/e2b/keys	200	25.0	131 B	pass
List the running sandboxes (empty)	GET /e2b/sandboxes	200	5.00	2 B	pass
List the sandboxes by state (empty)	GET /e2b/v2/sandboxes?state=running,paused	200	8.00	2 B	pass
List every sandbox for the owner's console (empty)	GET /v1/e2b/sandboxes	200	2.00	16 B	pass
Get a sandbox that does not exist	GET /e2b/sandboxes/sb0000000000000000	404	1.00	87 B	pass
Refuse the sandbox list without an E2B key	GET /e2b/sandboxes	401	2.00	92 B	pass
List the templates and their builds (empty)	GET /v1/e2b/templates	200	2.00	16 B	pass
Revoke the E2B key	DELETE /v1/e2b/keys/e2k-e2eb073fb4d2	200	34.0	11 B	pass

conversations15 requests

Request	Call	Status	ms	Size	Result
List the owner's conversations on a hub with none	GET /v1/owner/conversations	200	1.00	2 B	pass
Refuse a conversation while no orchestrator is connected	POST /v1/owner/conversations	409	2.00	118 B	pass
Refuse a conversation with no text	POST /v1/owner/conversations	400	2.00	34 B	pass
Refuse a conversation with an empty message	POST /v1/owner/conversations	400	1.00	34 B	pass
Answer 404 for an unknown conversation	GET /v1/owner/conversations/conv-999	404	2.00	32 B	pass
Answer 404 for a message to an unknown conversation	POST /v1/owner/conversations/conv-999/messages	404	1.00	36 B	pass
Answer 404 when renaming an unknown conversation	PATCH /v1/owner/conversations/conv-999	404	12.0	36 B	pass
Refuse an empty title	PATCH /v1/owner/conversations/conv-999	400	2.00	37 B	pass
Answer 404 for an unknown conversation's transcript	GET /v1/owner/conversations/conv-999/transcript	404	2.00	32 B	pass
List the conversations with the archived ones	GET /v1/owner/conversations?archived=true	200	1.00	2 B	pass
Answer 404 for an unknown conversation's draft	GET /v1/owner/conversations/conv-999/draft	404	3.00	32 B	pass
Answer 404 when editing an unknown conversation's draft	PATCH /v1/owner/conversations/conv-999/draft	404	3.00	32 B	pass
Refuse a draft edit with a field drafts do not have	PATCH /v1/owner/conversations/conv-999/draft	400	2.00	162 B	pass
Answer 404 when starting an unknown conversation's project	POST /v1/owner/conversations/conv-999/start	404	2.00	36 B	pass
Refuse a start that names no revision	POST /v1/owner/conversations/conv-999/start	400	2.00	65 B	pass

weft7 requests

Request	Call	Status	ms	Size	Result
Show whether Weft is running on a fresh hub	GET /v1/weft	200	2.00	46 B	pass
List the Weft repositories on a fresh hub	GET /v1/weft/repos	200	6.00	361 B	pass
List the language packs Weft has loaded	GET /v1/weft/packs	200	6.00	318 B	pass
List the Weft keys, with the owner's on a fresh hub	GET /v1/weft/keys	200	6.00	634 B	pass
List the Weft operations log, newest first	GET /v1/weft/ops?limit=20	200	2.00	741 B	pass
List the review recipes and the proposals waiting	GET /v1/recipes	200	1.00	556 B	pass
Show the code review recipe as its TOML	GET /v1/recipes/code	200	4.00	6.0 KiB	pass

platforms4 requests

Request	Call	Status	ms	Size	Result
List the git platforms on a fresh hub	GET /v1/platforms	200	2.00	323 B	pass
Start creating the GitHub App	POST /v1/platforms/github/app	200	2.00	129 B	pass
A callback with an unknown state does nothing	GET /v1/platforms/callback?code=x&state=unknown	400	2.00	501 B	pass
An organisation-level token must name its organisation	POST /v1/platforms/tokens	400	2.00	71 B	pass

projects-life16 requests

Request	Call	Status	ms	Size	Result
List the project modes	GET /v1/project-modes	200	2.00	371 B	pass
Bring in a finished project from a git address	POST /v1/projects/adopt	201	38.0	1.4 KiB	pass
Put the project back in build	POST /v1/projects/pr3/mode	200	8.00	988 B	pass
Answer 400 for a mode that does not exist	POST /v1/projects/pr3/mode	400	3.00	35 B	pass
Get the maintenance view of a fresh project	GET /v1/projects/pr3/maintenance	200	2.00	357 B	pass
Add a signal to the project's inbox	POST /v1/projects/pr3/maintenance/signals	201	3.00	183 B	pass
Make the project's ingest address	POST /v1/projects/pr3/maintenance/ingest	201	3.00	139 B	pass
Send a signal to the ingest address without a token	POST /v1/ingest/apzi_fa9cc819ec2a5986d3d31d05bb02fcdcbf8dbd50d998edd0	202	2.00	11 B	pass
Answer 404 for an ingest address that does not exist	POST /v1/ingest/apzi_not-a-real-address	404	1.00	34 B	pass
Answer 404 when approving a proposal that does not exist	POST /v1/projects/pr3/maintenance/proposals/mp999/approve	404	2.00	28 B	pass
List the project's environments	GET /v1/projects/pr3/environments	200	3.00	247 B	pass
Put a staging environment that tracks main	PUT /v1/projects/pr3/environments/staging	200	3.00	239 B	pass
Deploy a named version to staging	POST /v1/projects/pr3/environments/staging/deploy	200	14.0	96 B	pass
Put a secret for the staging environment	PUT /v1/projects/pr3/environments/staging/secrets/STAGING_DEPLOY_TOKEN	200	48.0	63 B	pass
Upload a file's bytes into the project	PUT /v1/projects/pr3/uploads	201	35.0	85 B	pass
Land the uploaded file on main as one change	POST /v1/projects/pr3/files	200	63.0	109 B	pass

looks13 requests

Request	Call	Status	ms	Size	Result
Read the appearance (the default look)	GET /v1/appearance	200	2.00	112 B	pass
Save a chosen built-in look	PUT /v1/appearance	200	2.00	115 B	pass
Refuse a look that names no known theme	PUT /v1/appearance	400	2.00	43 B	pass
Save a valid custom theme	PUT /v1/appearance/themes/my-theme	200	3.00	250 B	pass
Refuse a custom theme that takes a built-in id	PUT /v1/appearance/themes/loom-clay	400	2.00	68 B	pass
Refuse a theme whose body id differs from the URL	PUT /v1/appearance/themes/other	400	3.00	56 B	pass
Delete the custom theme	DELETE /v1/appearance/themes/my-theme	200	7.00	115 B	pass
Put the default look back	PUT /v1/appearance	200	3.00	112 B	pass
List the artifacts	GET /v1/artifacts	200	3.00	2 B	pass
Read an artifact that does not exist	GET /v1/artifacts/aunknownid00	404	3.00	39 B	pass
List the share links	GET /v1/shares	200	3.00	2 B	pass
Refuse a share link for an artifact that does not exist	POST /v1/shares	404	2.00	36 B	pass
Read the data of an artifact that does not exist	GET /artifact/0123456789abcdef0123456789abcdef/data	404	2.00	19 B	pass

Timings

Every GET in the spec without path parameters, requested 20 times in a row on the CI runner, slowest p95 first. Times are milliseconds on a shared runner: compare them run to run, not to production. The last column is the p95's change against main.

Route	What it does	Status	p50	p95	max	Size	vs main
/v1/overview	Read the hub's overview	200	5.07	96.1	96.1	224 B	-1%
/v1/prices	List the model prices	200	13.7	53.9	53.9	488.7 KiB	+540%
/v1/laws/rules	List the owner's rules and overrides	200	5.73	50.2	50.2	87 B	+2598%
/v1/foundry/jobs	List the jobs, newest first	200	3.18	28.4	28.4	2 B	+660%
/v1/stations/recording-defaults	Show the recording defaults for new workstations	200	5.41	25.8	25.8	74 B	+2286%
/v1/metrics/alerts	List the alerts and their state	200	4.36	25.7	25.7	2.3 KiB	+491%
/v1/stations	List the workstations	200	3.67	23.3	23.3	2 B	+1905%
/v1/machine	Read this machine's facts	502	3.92	21.5	21.5	101 B	+162%
/v1/machines	List the machines on this plaza	200	4.60	20.6	20.6	58 B	+177%
/v1/acp	Open an editor's ACP socket	409	2.91	19.6	19.6	104 B	+227%
/v1/loops	List the scheduled loops	200	2.12	18.6	18.6	2 B	+502%
/v1/runs	List the runs on this machine	502	4.03	18.5	18.5	101 B	+12%
/v1/hub	Read the hub's status	502	2.83	17.8	17.8	101 B	+157%
/v1/ide/audit	List the IDE's audit log	200	3.95	17.6	17.6	2 B	+184%
/v1/mcp/catalog	List the MCP server presets	200	3.93	17.4	17.4	4.2 KiB	+765%
/v1/toolbox	List the toolbox discoveries	200	4.28	16.3	16.3	2 B	+540%
/v1/usage/calls	List the newest model calls	200	1.87	15.4	15.4	41 B	+467%
/v1/prompts	List the prompts	200	5.93	15.0	15.0	5.3 KiB	+615%
/v1/vault	Show the vault's state	200	3.94	14.5	14.5	245 B	+639%
/v1/providers	List the providers	200	6.77	14.1	14.1	7.0 KiB	+108%
/v1/decisions/default	Get the default decision model	200	3.21	13.4	13.4	30 B	+120%
/v1/metrics/forecast	Show the capacity forecast	200	6.61	12.9	12.9	187 B	+221%
/v1/skills/rules	List the skill rules and the template	200	5.19	12.6	12.6	2.3 KiB	+378%
/v1/ide/workspaces	List the IDE's workspaces	200	6.10	11.9	11.9	511 B	+260%
/v1/stations/audit	List the station audit, newest first	200	2.93	11.8	11.8	2 B	+828%
/v1/metrics/view	Compose a metrics view	200	7.41	11.5	11.5	3.7 KiB	+35%
/v1/hub-mcp/tokens	List the MCP tokens	200	2.21	11.0	11.0	192 B	+279%
/v1/prompts/rules	List the prompt rules and templates	200	3.38	11.0	11.0	5.5 KiB	+427%
/v1/motions	List the motions	200	1.98	11.0	11.0	214 B	+81%
/v1/metrics/slos	List the service-level objectives	200	6.26	10.7	10.7	785 B	+219%
/v1/laws	List the laws and how often each refused a call	200	6.54	10.6	10.6	104.2 KiB	+87%
/v1/metrics/export	Export a view as CSV	200	6.99	10.6	10.6	24 B	+103%
/v1/agents	List the agents	200	3.19	9.90	9.90	2 B	+182%
/v1/treasury/series	Show the treasury over time	200	2.34	9.67	9.67	9.9 KiB	+126%
/v1/connectors/proposals	List connector proposals, newest first	200	2.42	9.53	9.53	2 B	+410%
/v1/tasks	List the tasks	200	3.89	9.36	9.36	985 B	+92%
/v1/volumes	List the data volumes	502	5.14	9.22	9.22	101 B	+86%
/v1/sanctions	List the sanctions and suspensions	200	2.65	9.18	9.18	33 B	+263%
/v1/skills/export	Export several skills as one zip	422	5.47	8.93	8.93	24 B	+224%
/v1/foundry/hf/status	Show the Hugging Face status	200	3.94	8.69	8.69	115 B	+78%
/v1/templates	List the warm templates	502	2.87	8.62	8.62	101 B	+14%
/v1/hub/identity	Show the hub's identity	200	2.69	8.59	8.59	99 B	+232%
/v1/foundry/recipes	List the recipes	200	3.03	8.58	8.58	541 B	+3%
/v1/agora	Show the agora's calls	200	2.28	8.42	8.42	52 B	+132%
/v1/roles	List the built-in and custom roles	200	3.82	8.37	8.37	52.0 KiB	-5%
/v1/society	Show the society: agents, bonds and reputations	200	2.70	8.34	8.34	52 B	-17%
/v1/treasury/journal	List the treasury journal	200	2.41	8.15	8.15	2.3 KiB	-7%
/v1/appearance	Read the owner's appearance and saved themes	200	2.11	8.07	8.07	112 B	new
/v1/projects	List the projects	200	2.85	7.83	7.83	2.7 KiB	+114%
/v1/laws/violations	List the recorded refusals of a law	200	4.27	7.81	7.81	2 B	+379%
/v1/files	List the files agents handed in	200	2.34	7.62	7.62	2 B	+15%
/v1/metrics/around	Show what changed around a time	200	4.42	7.60	7.60	202 B	+36%
/v1/treasury	Show the treasury balances	200	3.10	7.48	7.48	759 B	+96%
/v1/usage-providers	List the usage providers (CLIProxyAPI hubs) and their last readings	200	2.69	7.39	7.39	2 B	new
/v1/agent-proposals	List the agent proposals	200	2.45	7.38	7.38	2 B	+590%
/v1/skills	List the skills, or the archived ones	200	2.94	7.38	7.38	556 B	+481%
/v1/robots/species	List the robot species with counts	200	4.50	7.34	7.34	1.2 KiB	+43%
/v1/board/export	Export a board thread as Markdown or JSON	200	2.69	7.20	7.20	69 B	+153%
/v1/library	List the library's tool versions	200	2.59	7.10	7.10	2 B	+154%
/v1/platforms	List the git platforms the plaza is authorized on	200	2.64	7.10	7.10	323 B	new
/v1/vault/audit	Read the audit log, verifying it on request	200	4.75	6.88	6.88	1.6 KiB	+253%
/v1/conversations	List the conversations	200	2.20	6.79	6.79	147 B	+103%
/v1/foundry/hf/imports	List the Hugging Face imports	200	2.78	6.56	6.56	14 B	+90%
/v1/stations/recordings	List the station recordings, newest first	200	2.95	6.50	6.50	2 B	+491%
/v1/auth/check	Check that the session is signed in	200	3.69	6.49	6.49	11 B	+185%
/v1/hub-mcp/calls	List the recent MCP calls	200	2.35	6.27	6.27	12 B	+48%
/v1/mcp/servers	List the MCP servers	200	2.91	6.21	6.21	2 B	+103%
/v1/vault/consumers	List each consumer and its resolved entry	200	3.29	6.21	6.21	4.0 KiB	+133%
/v1/shares	List the share links, all of them or those of one target	200	2.21	6.08	6.08	2 B	new
/v1/foundry/datasets	List the datasets	200	3.57	6.02	6.02	2 B	+179%
/v1/fleet	List the machines and the agents on them	200	3.16	5.97	5.97	295 B	+169%
/v1/platforms/callback	Take the browser back from a platform	400	3.06	5.94	5.94	501 B	new
/v1/connectors	List the connectors and their settings	200	2.85	5.92	5.92	11.6 KiB	-50%
/v1/project-modes	List the modes a project can be in	200	2.10	5.89	5.89	371 B	new
/v1/vault/secrets	List the vault's entries	200	2.63	5.83	5.83	1.1 KiB	+217%
/v1/owner/conversations	List the owner's conversations with the orchestrator	200	2.20	5.70	5.70	2 B	new
/v1/hub-mcp	Show the hub's MCP server status	200	3.40	5.61	5.61	278 B	+80%
/v1/foundry/devices	List the accelerators and the jobs holding them	200	3.60	5.60	5.60	15 B	+28%
/v1/infractions	List the recent infractions	200	2.29	5.59	5.59	2 B	+94%
/v1/engines	List the coding engines: the built-in ones and the instances the owner added	200	2.60	5.29	5.29	4.2 KiB	new
/v1/egress/inject	List the egress injection rules	200	2.19	5.22	5.22	12 B	+235%
/v1/metrics/traces	List the kept traces	200	2.35	5.21	5.21	2 B	+218%
/v1/foundry/models	List the foundry's models	200	3.23	5.12	5.12	13 B	+45%
/v1/metrics/events	List the metric events	200	2.73	5.10	5.10	2 B	+217%
/v1/node-link	Read this machine's link to a hub	200	2.28	5.02	5.02	81 B	+118%
/v1/weft	Show whether Weft, the plaza's version control, is running	200	3.09	4.99	4.99	46 B	new
/v1/metrics/calls/page	Load the next page of calls	200	2.54	4.97	4.97	351 B	+76%
/v1/nodes	List the plaza's machines	200	2.62	4.95	4.95	312 B	+111%
/v1/usage/series	Show usage over time, bucketed	200	2.65	4.86	4.86	28.0 KiB	+78%
/v1/provider-catalog	What the Add provider dialog offers: the API kinds and the coding engines	200	3.21	4.80	4.80	9.6 KiB	new
/v1/nodes/codes	List the join codes	200	1.98	4.78	4.78	121 B	+149%
/v1/usage/summary	Summarize usage over a time window	200	2.47	4.77	4.77	252 B	-31%
/v1/settings	Get the hub's settings	200	2.49	4.66	4.66	1.3 KiB	-18%
/v1/metrics/dashboards	Read the saved dashboards	200	2.36	4.59	4.59	50 B	+410%
/v1/metrics/catalog	Read the metric catalog	200	2.03	4.53	4.53	28.4 KiB	+189%
/v1/recipes	List the review recipes and the orchestrator's proposals	200	3.11	4.52	4.52	556 B	new
/v1/metrics	Scrape the hub's Prometheus metrics	200	2.02	4.39	4.39	5.1 KiB	+129%
/v1/e2b/sandboxes	List all sandboxes for the owner's console	200	2.82	4.37	4.37	16 B	+150%
/v1/e2b/templates	List the templates and their builds	200	2.03	4.31	4.31	16 B	+168%
/v1/metrics/settings	Read the metrics settings	200	2.44	4.28	4.28	292 B	+163%
/v1/artifacts	List the artifacts, newest first (?project=, ?q=)	200	1.93	4.18	4.18	2 B	new
/v1/stations/link	Open the workstation daemon's link socket	401	1.70	4.10	4.10	61 B	+204%
/v1/metrics/calls	List the agents' calls	200	2.37	3.79	3.79	2 B	+16%
/v1/approvals	List the approvals, pending and decided	200	2.42	3.78	3.78	2 B	+122%
/v1/metrics/scopes	List the metric scopes	200	2.48	3.63	3.63	6.3 KiB	+4%
/v1/acp/sessions	List the editor (ACP) sessions	200	2.37	3.30	3.30	2 B	-48%
/v1/e2b/keys	List the E2B API keys	200	2.44	3.29	3.29	11 B	+75%
/v1/treasury/wallets	List the agent wallets	200	2.35	3.28	3.28	2 B	+14%
/v1/stations/vms	List the workstation VMs	200	2.03	3.24	3.24	2 B	+122%
/v1/stations/codes	List the join codes	200	2.43	3.08	3.08	2 B	+18%
/v1/plaza/state	Show whether the plaza is stopped	200	2.11	3.02	3.02	63 B	+80%
/v1/ws	Open a socket that streams the hub's events	400	2.26	2.84	2.84	79 B	-55%
/v1/provider-kinds	List the provider kinds you can add	200	2.06	2.59	2.59	8.3 KiB	-75%
/v1/board	Read the board	200	1.95	2.37	2.37	134 B	-72%

Fuzzing (Schemathesis)

Requests generated from docs/api/openapi.json: a 5xx answer or a connection dropped without an answer is a finding. 502 and 503 come from the scratch hub's missing node daemon and git host. Reported here; findings do not fail the pull request yet.

Server error17

Operation	What happened
POST /v1/agent-proposals/{id}/approve	1. Test Case ID: SVlIBE - Server error [502] Bad Gateway: `{"error":"no node 0"}` Reproduce with: curl -X POST http://127.0.0.1:17777/v1/nodes/0/runs
POST /v1/nodes/{id}/results	1. Test Case ID: WfGQJY - Server error [502] Bad Gateway: `{"error":"127.0.0.1:1 unreachable: cannot connect to 127.0.0.1:1: Connection refused (os error 111)"}` Reproduce with: curl -X POST http://127.0.0.1:17777/v1/runs
POST /v1/sanctions/{id}/lift	1. Test Case ID: bLlnag - Server error [502] Bad Gateway: `{"error":"127.0.0.1:1 unreachable: cannot connect to 127.0.0.1:1: Connection refused (os error 111)"}` Reproduce with: curl -X POST http://127.0.0.1:17777/v1/runs/0/input
POST /v1/skills	1. Test Case ID: kOst0l - Server error [503] Service Unavailable: `{"error":"vault sealed"}` Reproduce with: curl -X POST -H 'Authorization: [Filtered]' http://127.0.0.1:17777/v1/vault/recovery
POST /v1/vault/seal	1. Test Case ID: j3rOke - Server error [502] Bad Gateway: `{"error":"127.0.0.1:1 unreachable: cannot connect to 127.0.0.1:1: Connection refused (os error 111)"}` Reproduce with: curl -X POST http://127.0.0.1:17777/v1/volumes
POST /v1/weft/{rest}	1. Test Case ID: r3Dvbm - Server error [502] Bad Gateway: `{"error":"127.0.0.1:2 unreachable: cannot connect to 127.0.0.1:2: Connection refused (os error 111)"}` Reproduce with: curl -X GET http://127.0.0.1:17777/v1/hub
GET /v1/hub-mcp	1. Test Case ID: egZf4m - Server error [502] Bad Gateway: `{"error":"127.0.0.1:1 unreachable: cannot connect to 127.0.0.1:1: Connection refused (os error 111)"}` Reproduce with: curl -X GET http://127.0.0.1:17777/v1/machine
GET /v1/mcp/servers	1. Test Case ID: XfuSdX - Server error [502] Bad Gateway: `{"error":"no node 0"}` Reproduce with: curl -X GET http://127.0.0.1:17777/v1/nodes/0/machine
GET /v1/nodes	1. Test Case ID: t51xDF - Server error [502] Bad Gateway: `{"error":"no node 0"}` Reproduce with: curl -X GET http://127.0.0.1:17777/v1/nodes/0/stats
GET /v1/nodes/{id}/runs	1. Test Case ID: YGfqVP - Server error [502] Bad Gateway: `{"error":"no node 0"}` Reproduce with: curl -X GET http://127.0.0.1:17777/v1/nodes/0/runs
GET /v1/owner/conversations	1. Test Case ID: sREvjD - Server error [502] Bad Gateway: `{"error":"127.0.0.1:1 unreachable: cannot connect to 127.0.0.1:1: Connection refused (os error 111)"}` Reproduce with: curl -X GET http://127.0.0.1:17777/v1/runs
GET /v1/runs/{id}	1. Test Case ID: wUVx2k - Server error [502] Bad Gateway: `{"error":"127.0.0.1:1 unreachable: cannot connect to 127.0.0.1:1: Connection refused (os error 111)"}` Reproduce with: curl -X GET http://127.0.0.1:17777/v1/runs/0
GET /v1/sanctions	1. Test Case ID: WQh3ay - Server error [502] Bad Gateway: `{"error":"127.0.0.1:1 unreachable: cannot connect to 127.0.0.1:1: Connection refused (os error 111)"}` Reproduce with: curl -X GET http://127.0.0.1:17777/v1/templates
GET /v1/treasury/journal	1. Test Case ID: Raunbk - Server error [502] Bad Gateway: `{"error":"127.0.0.1:1 unreachable: cannot connect to 127.0.0.1:1: Connection refused (os error 111)"}` Reproduce with: curl -X GET http://127.0.0.1:17777/v1/volumes
GET /v1/weft	1. Test Case ID: UHBt3y - Server error [502] Bad Gateway: `{"error":"127.0.0.1:1 unreachable: cannot connect to 127.0.0.1:1: Connection refused (os error 111)"}` Reproduce with: curl -X DELETE http://127.0.0.1:17777/v1/runs/0
DELETE /v1/shares/{id}	1. Test Case ID: BYCWfD - Server error [502] Bad Gateway: `{"error":"127.0.0.1:1 unreachable: cannot connect to 127.0.0.1:1: Connection refused (os error 111)"}` Reproduce with: curl -X DELETE http://127.0.0.1:17777/v1/templates/0
DELETE /v1/toolbox/{id}	1. Test Case ID: 0MDTvh - Server error [502] Bad Gateway: `{"error":"127.0.0.1:1 unreachable: cannot connect to 127.0.0.1:1: Connection refused (os error 111)"}` Reproduce with: curl -X DELETE http://127.0.0.1:17777/v1/volumes/0

Coverage by area

Area	Tested
internal	0/42
e2b	7/39
projects	29/38
stations	5/38
agents	5/35
foundry	6/33
metrics	5/27
skills	5/23
nodes	7/18
vault	5/17
platforms	4/17
ide	2/15
prompts	5/15
mcp	5/13
tasks	6/11
providers	5/10
owner	9/10
laws	4/10
artifact	1/9
artifacts	2/8
engines	0/7
board	2/7
connectors	0/7
treasury	0/6
hub-mcp	3/6
runs	0/5
motions	0/5
files	0/5
shares	2/5
usage-providers	0/4
library	4/4
appearance	4/4
weft	2/4
recipes	2/4
egress	0/4
hub	1/3
volumes	0/3
acp	0/3
decisions	1/3
toolbox	0/3
loops	0/3
plaza	0/3
roles	3/3
agent-proposals	2/3
prices	2/3
usage	1/3
node-link	0/3
auth	2/3
console	1/3
templates	0/2
settings	2/2
conversations	0/2
approvals	2/2
sanctions	2/2
reviews	0/2
unfurl	0/2
overview	1/1
machines	0/1
machine	0/1
ws	0/1
provider-kinds	0/1
models	0/1
provider-catalog	0/1
agora	0/1
society	0/1
project-modes	1/1
ingest	1/1
infractions	0/1
fleet	0/1
robots	0/1

Made by api-tests/run.sh in the pull request gate. Bodies are scrubbed of tokens and secrets before they are published.