API Reference

Most endpoints are served under /api/ and return JSON. Authentication is required unless an endpoint is listed as public. The Prometheus scrape endpoint /metrics is intentionally open (Prometheus convention) and lives outside the /api tree.

Authentication

Three methods:

JWT Bearer — Authorization: Bearer <token>
Session cookie — set automatically on login
API key — X-API-Key: cb_<key>

Roles

Role	Code	Permissions
Admin	`a`	Full access
Operator	`w`	CRUD resources, container actions, workflows, backups
Viewer	`r`	Read-only access

Error Format

{"error": "description of what went wrong"}

Status codes: 400, 401, 403, 404, 409, 500

REST Endpoints

Health & Bootstrap (public)

Method	Path	Auth	Description
`GET`	`/metrics`	public	Prometheus scrape endpoint (no /api prefix; cb-prometheus scrapes here)
`GET`	`/api/health`	public	Health check
`GET`	`/api/modules`	public	List enabled modules
`POST`	`/api/enroll`	public	Worker enrollment (rate-limited 10/min/IP, requires shared_secret + enroll_token)
`POST`	`/api/webhooks/alertmanager`	public	Alertmanager → CB events bridge
`POST`	`/api/webhooks/n8n/callback`	public	n8n workflow callbacks
`POST`	`/api/webhooks/wazuh`	public	Wazuh alert webhook (HMAC verified)

Auth

Method	Path	Auth	Description
`POST`	`/api/auth/login`	public	Log in and obtain JWT + session cookie
`POST`	`/api/auth/setup`	public	Create initial admin user (one-time, then disabled)
`POST`	`/api/auth/refresh`	public	Refresh an expiring JWT
`POST`	`/api/auth/logout`	r	Invalidate current session
`GET`	`/api/auth/me`	r	Get current user info
`POST`	`/api/admin/secrets/rotate-jwt`	a	Rotate the JWT signing secret

Users

Method	Path	Auth	Description
`GET`	`/api/users`	a	List all users
`POST`	`/api/users`	a	Create user
`GET`	`/api/users/{id}`	a	Get user
`PUT`	`/api/users/{id}`	a	Update user
`DELETE`	`/api/users/{id}`	a	Delete user

API Keys

Method	Path	Auth	Description
`GET`	`/api/keys`	r	List your API keys
`POST`	`/api/keys`	r	Create API key
`DELETE`	`/api/keys/{id}`	r	Revoke API key

Hosts (pending + enrolled)

Method	Path	Auth	Description
`GET`	`/api/hosts`	r	List hosts (pending + enrolled)
`POST`	`/api/hosts`	a	Create a host placeholder + mint enroll token
`GET`	`/api/hosts/{id}`	r	Get host details (token TTL, install snippet)
`POST`	`/api/hosts/{id}/fuse`	a	Fuse the host once Sentinel + Edge Agent both report in
`POST`	`/api/hosts/{id}/retry-fuse`	a	Re-attempt fuse if it stalled
`POST`	`/api/hosts/{id}/regenerate-token`	a	Mint a fresh enroll token (invalidates the old one)
`GET`	`/api/hosts/{id}/enroll-attempts`	r	Recent enroll attempts with reason codes (for the rejection log)
`DELETE`	`/api/hosts/{id}`	a	Remove host

Nodes (enrolled)

Method	Path	Auth	Description
`GET`	`/api/nodes`	r	List all nodes
`GET`	`/api/nodes/fleet-status`	r	Fleet health snapshot
`GET`	`/api/nodes/{id}`	r	Get node details
`DELETE`	`/api/nodes/{id}`	a	Remove node
`PUT`	`/api/nodes/{id}/labels`	w	Update node labels
`GET`	`/api/nodes/{id}/security-policy`	r	Get per-node security policy
`PUT`	`/api/nodes/{id}/security-policy`	w	Update per-node security policy
`GET`	`/api/nodes/{id}/census`	r	Latest deep-system census
`POST`	`/api/nodes/{id}/census`	w	Trigger a fresh census
`GET`	`/api/nodes/{id}/census/diff`	r	Diff against the previous census
`GET`	`/api/census`	r	List census snapshots

Mesh (Headscale)

Method	Path	Auth	Description
`POST`	`/api/mesh/enroll`	a	Mint a Headscale pre-auth key for a host
`GET`	`/api/mesh/status`	a	Mesh control-plane status
`GET`	`/api/mesh/nodes`	a	List nodes in the mesh
`GET`	`/api/mesh/nodes/{id}`	a	Get a mesh node
`DELETE`	`/api/mesh/nodes/{id}`	a	Remove a mesh node

Containers

Method	Path	Auth	Description
`GET`	`/api/containers`	r	List containers
`POST`	`/api/containers`	w	Create container
`GET`	`/api/containers/{id}`	r	Get container
`GET`	`/api/containers/{id}/inspect`	r	Docker inspect
`POST`	`/api/containers/{id}/{action}`	w	Container action (start/stop/restart)
`DELETE`	`/api/containers/{id}`	w	Remove container
`GET`	`/api/containers/{id}/logs`	r	Fetch logs (HTTP, one-shot)
`GET`	`/api/containers/{id}/logs/ws`	r	Stream logs (WebSocket)
`GET`	`/api/containers/{id}/exec/ws`	a	Shell exec (WebSocket)
`GET`	`/api/containers/stats`	r	Container stats

Stacks

Method	Path	Auth	Description
`GET`	`/api/stacks`	r	List all stacks
`POST`	`/api/stacks`	w	Create stack
`GET`	`/api/stacks/{id}`	r	Get stack
`PUT`	`/api/stacks/{id}`	w	Update stack
`DELETE`	`/api/stacks/{id}`	w	Delete stack
`POST`	`/api/stacks/{id}/{action}`	w	Stack action (deploy/stop/remove)

Services (compose / swarm services)

Method	Path	Auth	Description
`GET`	`/api/services`	r	List services across endpoints
`GET`	`/api/services/{id}`	r	Get service
`DELETE`	`/api/services/{id}`	w	Remove service
`PUT`	`/api/services/{id}/health`	w	Update CB-tracked health snapshot for a service

Images

Method	Path	Auth	Description
`GET`	`/api/images`	r	List images
`POST`	`/api/images/pull`	w	Pull image
`DELETE`	`/api/images/{id}`	w	Remove image
`POST`	`/api/images/prune`	w	Prune unused images

Volumes

Method	Path	Auth	Description
`GET`	`/api/volumes`	r	List volumes
`DELETE`	`/api/volumes/{name}`	w	Remove volume

Networks

Method	Path	Auth	Description
`GET`	`/api/networks`	r	List Docker networks
`DELETE`	`/api/networks/{id}`	w	Remove a network
`GET`	`/api/networks/topology`	r	Network topology graph
`GET`	`/api/networks/{id}/inspect`	r	Inspect a network

Portainer endpoints

Method	Path	Auth	Description
`GET`	`/api/endpoints`	a	List Portainer endpoints (local + Edge Agents)
`POST`	`/api/endpoints`	a	Register a new endpoint
`DELETE`	`/api/endpoints/{id}`	a	Remove an endpoint

Workflows (n8n)

Requires: modules.workflows = true

Method	Path	Auth	Description
`GET`	`/api/n8n/status`	r	n8n connection + bootstrap status
`GET`	`/api/n8n/workflows`	r	List n8n workflows (proxied via API key)
`GET`	`/api/n8n/workflows/{id}`	r	Get an n8n workflow
`POST`	`/api/n8n/workflows/{id}/execute`	w	Trigger an n8n workflow
`POST`	`/api/n8n/workflows/{id}/activate`	w	Activate / deactivate
`DELETE`	`/api/n8n/workflows/{id}`	w	Delete workflow
`GET`	`/api/n8n/executions`	r	List recent executions
`GET`	`/api/n8n/event-webhooks`	r	List event-bus → n8n webhook bindings
`PUT`	`/api/n8n/event-webhooks`	w	Update event-bus → n8n webhook bindings

Monitoring (Prometheus + Grafana)

Requires: modules.monitoring = true

Method	Path	Auth	Description
`GET`	`/api/metrics/query`	r	Query time-series metrics (CB cache)
`GET`	`/api/metrics/latest`	r	Latest metric values
`GET`	`/api/metrics/targets`	r	Configured scrape targets
`GET`	`/api/metrics/history`	r	List saved PromQL history entries
`POST`	`/api/metrics/history`	r	Save a PromQL query into history
`GET`	`/api/v1/metrics/query`	r	Prometheus query proxy (PromQL)
`POST`	`/api/v1/metrics/query`	r	Prometheus query proxy (POST form)
`GET`	`/api/v1/metrics/query_range`	r	Prometheus query_range proxy
`POST`	`/api/v1/metrics/query_range`	r	Prometheus query_range proxy (POST form)
`GET`	`/api/v1/metrics/series`	r	Prometheus series proxy
`GET`	`/api/v1/metrics/labels`	r	Prometheus labels proxy
`GET`	`/api/v1/metrics/label/{name}/values`	r	Prometheus label values proxy
`GET`	`/api/v1/metrics/metadata`	r	Prometheus metric metadata
`GET`	`/api/prometheus/targets`	r	Prometheus target health
`GET`	`/api/prometheus/rules`	r	Loaded recording / alert rules
`GET`	`/api/prometheus/status`	r	Prometheus runtime status
`GET`	`/api/grafana/dashboards`	r	List Grafana dashboards (provisioned + user)
`POST`	`/api/grafana/dashboards`	w	Create / save dashboard
`GET`	`/api/grafana/dashboards/{uid}`	r	Get dashboard
`DELETE`	`/api/grafana/dashboards/{uid}`	w	Delete dashboard
`POST`	`/api/grafana/dashboards/{uid}/star`	r	Star a dashboard
`DELETE`	`/api/grafana/dashboards/{uid}/star`	r	Un-star a dashboard
`POST`	`/api/grafana/annotations`	w	Push annotation (used by event bus on alerts)

Alerting (Alertmanager-backed)

Requires: modules.alerting = true

Method	Path	Auth	Description
`GET`	`/api/alerts`	r	List alerts
`POST`	`/api/alerts/{id}/acknowledge`	w	Acknowledge alert
`POST`	`/api/alerts/{id}/resolve`	w	Resolve alert
`GET`	`/api/alert-rules`	r	List alert rules (synced into prometheus.yml)
`POST`	`/api/alert-rules`	w	Create alert rule
`PUT`	`/api/alert-rules/{id}`	w	Update alert rule
`DELETE`	`/api/alert-rules/{id}`	w	Delete alert rule
`GET`	`/api/alertmanager/silences`	r	List Alertmanager silences
`POST`	`/api/alertmanager/silences`	w	Create a silence
`DELETE`	`/api/alertmanager/silences/{id}`	w	Delete a silence

AI (tiered router: Ollama + Claude)

Requires: modules.ai = true

Method	Path	Auth	Description
`POST`	`/api/ai/chat`	r	Chat completion (SSE when stream: true)
`GET`	`/api/ai/models`	r	List available models
`GET`	`/api/ai/status`	r	Endpoint health and capabilities
`GET`	`/api/ai/router/status`	r	Tiered router state (Ollama vs Claude routing decisions)
`GET`	`/api/ai/claude/status`	r	Claude Agent SDK service status
`GET`	`/api/ai/context-preview`	r	Preview the assembled context for a request
`POST`	`/api/ai/tasks`	w	Create background AI task
`GET`	`/api/ai/tasks`	r	List tasks
`GET`	`/api/ai/tasks/{id}`	r	Get task
`POST`	`/api/ai/tasks/{id}/cancel`	w	Cancel task
`POST`	`/api/ai/tasks/{id}/retry`	w	Retry failed task
`POST`	`/api/ai/tasks/{id}/confirm`	w	Confirm a task that was waiting for human approval
`DELETE`	`/api/ai/tasks/{id}`	w	Delete task (and its transcript)
`POST`	`/api/ai/conversations`	w	Start a multi-task conversation
`GET`	`/api/ai/conversations/{id}/tasks`	r	List tasks in a conversation
`POST`	`/api/ai/sessions`	w	Start a Claude Code session
`GET`	`/api/ai/sessions`	r	List Claude sessions
`GET`	`/api/ai/sessions/{id}`	r	Get session (transcript + cost)
`PUT`	`/api/ai/sessions/{id}`	w	Update session metadata (title, pin, tags)
`DELETE`	`/api/ai/sessions/{id}`	w	End session
`GET`	`/api/ai/modes`	r	List agent modes (autonomous / supervised / read-only)
`POST`	`/api/ai/modes`	w	Create agent mode
`PUT`	`/api/ai/modes/{id}`	w	Update agent mode
`DELETE`	`/api/ai/modes/{id}`	w	Delete agent mode
`GET`	`/api/ai/skills`	r	List Claude skills
`GET`	`/api/ai/skills/{id}`	r	Get skill detail
`POST`	`/api/ai/skills/{id}/run`	w	Run a skill
`GET`	`/api/ai/mcp-servers`	r	List registered MCP servers
`POST`	`/api/ai/mcp-servers`	w	Register an MCP server
`GET`	`/api/ai/mcp-servers/{id}/health`	r	Probe MCP server
`PUT`	`/api/ai/mcp-servers/{id}`	w	Update MCP server config
`DELETE`	`/api/ai/mcp-servers/{id}`	w	Remove MCP server
`GET`	`/api/ai/mcp-tools`	r	List MCP tools exposed to Claude
`POST`	`/api/ai/mcp-tools/{name}/test`	w	Test-fire a tool

Security (Wazuh + scanners)

Requires: modules.security = true

Method	Path	Auth	Description
`GET`	`/api/security/stats`	r	Aggregate security stats
`GET`	`/api/security/events`	r	List security events
`GET`	`/api/security/defaults`	r	Get fleet-wide security defaults
`PUT`	`/api/security/defaults`	a	Set fleet-wide security defaults
`GET`	`/api/security/wazuh/agents`	r	List Wazuh agents
`GET`	`/api/security/wazuh/status`	r	Wazuh manager status
`GET`	`/api/security/wazuh/bridge-status`	r	CB→Wazuh bridge status
`GET`	`/api/security/wazuh/vulnerabilities/{agentID}`	r	Per-agent vulnerabilities
`GET`	`/api/security/wazuh/sca/{agentID}`	r	SCA policies for an agent
`GET`	`/api/security/wazuh/sca/{agentID}/checks/{policyID}`	r	SCA checks for a policy on an agent
`GET`	`/api/security/wazuh/rules`	r	Loaded Wazuh rules
`GET`	`/api/security/wazuh/rules/{ruleID}`	r	Detail for a specific rule
`GET`	`/api/security/wazuh/rules/files/{filename}`	r	Read a rule file
`PUT`	`/api/security/wazuh/rules/files/{filename}`	a	Upload / overwrite a rule file
`GET`	`/api/security/wazuh/decoders`	r	Loaded decoders
`GET`	`/api/security/wazuh/decoders/files/{filename}`	r	Read a decoder file
`PUT`	`/api/security/wazuh/decoders/files/{filename}`	a	Upload / overwrite a decoder file
`GET`	`/api/security/wazuh/lists`	r	List CDB lists
`GET`	`/api/security/wazuh/lists/files/{filename}`	r	Read a CDB list file
`PUT`	`/api/security/wazuh/lists/files/{filename}`	a	Upload / overwrite a CDB list file
`PUT`	`/api/security/wazuh/logtest`	a	Run a log line through Wazuh's logtest endpoint
`POST`	`/api/security/wazuh/active-response/{agentID}`	a	Trigger active response
`GET`	`/api/security/wazuh/groups`	r	List agent groups
`POST`	`/api/security/wazuh/groups`	a	Create a new agent group
`DELETE`	`/api/security/wazuh/groups/{name}`	a	Delete an agent group
`GET`	`/api/security/wazuh/groups/{name}/agents`	r	List agents in a group
`PUT`	`/api/security/wazuh/agents/{agentID}/group/{name}`	a	Assign agent to a group
`DELETE`	`/api/security/wazuh/agents/{agentID}/group/{name}`	a	Remove agent from a group
`GET`	`/api/security/wazuh/groups/{name}/config`	r	Read group config (agent.conf)
`PUT`	`/api/security/wazuh/groups/{name}/config`	a	Update group config
`PUT`	`/api/security/wazuh/agents/{agentID}/upgrade`	a	Upgrade a Wazuh agent
`PUT`	`/api/security/wazuh/agents/{agentID}/restart`	a	Restart a Wazuh agent
`GET`	`/api/security/wazuh/syscheck/{agentID}/detailed`	r	FIM details for an agent
`GET`	`/api/security/wazuh/syscheck/{agentID}/file`	r	FIM details for a single file
`GET`	`/api/security/vulnerabilities`	r	Vulnerability summary across the fleet
`GET`	`/api/security/vulnerabilities/{nodeID}`	r	Vulnerabilities for a specific node
`PUT`	`/api/security/vulnerabilities/{id}/status`	w	Update vuln triage status
`POST`	`/api/security/vulnerabilities/auto-track`	a	Auto-create planner issues for new vulns
`GET`	`/api/security/compliance/frameworks`	r	Compliance frameworks
`GET`	`/api/security/compliance/history`	r	Compliance score history
`GET`	`/api/security/compliance/mappings`	r	List rule → control mappings
`PUT`	`/api/security/compliance/mappings`	a	Upsert a compliance mapping
`GET`	`/api/security/compliance/{framework}/score`	r	Per-framework score
`GET`	`/api/security/compliance/{framework}/checks`	r	Per-framework checks
`GET`	`/api/security/playbooks`	r	Remediation playbooks
`POST`	`/api/security/playbooks`	a	Create a custom playbook
`GET`	`/api/security/playbooks/{id}`	r	Get a playbook
`DELETE`	`/api/security/playbooks/{id}`	a	Delete a custom playbook
`GET`	`/api/security/playbooks/executions`	r	List playbook executions
`POST`	`/api/security/playbooks/{id}/execute`	a	Execute a playbook
`POST`	`/api/security/playbooks/executions/{executionID}/rollback`	a	Rollback a playbook execution
`GET`	`/api/security/correlate`	r	Correlate events across sources
`GET`	`/api/security/timeline`	r	Security event timeline
`GET`	`/api/security/soc/overview`	r	SOC overview

Knowledge / Brain

Requires: modules.knowledge = true

Method	Path	Auth	Description
`GET`	`/api/pages`	r	List pages (search with ?q=)
`GET`	`/api/pages/graph`	r	Get link graph
`GET`	`/api/pages/tags`	r	List tags with counts
`GET`	`/api/pages/{path...}`	r	Get page by path
`PUT`	`/api/pages/{path...}`	w	Create or update page
`POST`	`/api/pages/{path...}`	w	Create or update page (API-key-friendly alias)
`DELETE`	`/api/pages/{path...}`	w	Delete page
`GET`	`/api/page-history/{path...}`	r	List previous versions of a page
`GET`	`/api/page-version/{id}`	r	Get a specific version
`GET`	`/api/knowledge/search`	r	RAG search (Ollama embeddings)
`GET`	`/api/knowledge/stats`	r	RAG index stats
`GET`	`/api/knowledge/seed-status`	r	Seeded-doc status
`GET`	`/api/knowledge/project-status`	r	Per-project doc-coverage status (which projects have a Brain page)
`POST`	`/api/knowledge/regenerate-docs`	w	Regenerate seeded docs from in-tree templates

Project Planner

Requires: modules.planner = true

Method	Path	Auth	Description
`POST`	`/api/planner/projects`	w	Create project
`GET`	`/api/planner/projects`	r	List projects
`GET`	`/api/planner/projects/{id}`	r	Get project
`PUT`	`/api/planner/projects/{id}`	w	Update project
`DELETE`	`/api/planner/projects/{id}`	w	Delete project
`GET`	`/api/planner/projects/{id}/stats`	r	Project stats
`GET`	`/api/planner/projects/{id}/agent-summary`	r	Compact summary for AI agents
`GET`	`/api/planner/projects/{id}/board`	r	Kanban board
`GET`	`/api/planner/projects/{id}/timeline`	r	Gantt-style timeline
`GET`	`/api/planner/projects/{id}/backlog`	r	Backlog
`GET`	`/api/planner/projects/{id}/search`	r	Search issues within a project
`GET`	`/api/planner/projects/{id}/velocity`	r	Sprint velocity
`GET`	`/api/planner/projects/{id}/velocity/predict`	r	Predicted velocity
`GET`	`/api/planner/projects/{id}/cycle-time`	r	Cycle-time stats
`POST`	`/api/planner/projects/{id}/issues`	w	Create issue
`GET`	`/api/planner/projects/{id}/issues`	r	List issues
`GET`	`/api/planner/issues/{id}`	r	Get issue
`PUT`	`/api/planner/issues/{id}`	w	Update issue
`DELETE`	`/api/planner/issues/{id}`	w	Delete issue
`PATCH`	`/api/planner/issues/{id}/status`	w	Move issue across columns
`PATCH`	`/api/planner/issues/{id}/sprint`	w	Assign issue to a sprint
`PATCH`	`/api/planner/issues/{id}/priority`	w	Update issue priority
`POST`	`/api/planner/issues/bulk`	w	Bulk update issues
`POST`	`/api/planner/issues/from-spec`	w	Create issues from a structured spec
`POST`	`/api/planner/issues/from-agent`	w	Create issue from an AI agent suggestion
`POST`	`/api/planner/issues/{id}/agent-note`	w	Append an agent-authored note
`GET`	`/api/planner/issues/{id}/comments`	r	List comments on an issue
`POST`	`/api/planner/issues/{id}/comments`	w	Create comment
`DELETE`	`/api/planner/comments/{id}`	w	Delete comment
`GET`	`/api/planner/issues/{id}/dependencies`	r	List dependencies
`POST`	`/api/planner/issues/{id}/dependencies`	w	Add dependency
`DELETE`	`/api/planner/issues/{id}/dependencies/{depId}`	w	Remove dependency
`POST`	`/api/planner/projects/{id}/sprints`	w	Create sprint
`GET`	`/api/planner/projects/{id}/sprints`	r	List sprints
`GET`	`/api/planner/sprints/{id}`	r	Get sprint
`PUT`	`/api/planner/sprints/{id}`	w	Update sprint
`DELETE`	`/api/planner/sprints/{id}`	w	Delete sprint
`POST`	`/api/planner/sprints/{id}/start`	w	Start sprint
`POST`	`/api/planner/sprints/{id}/complete`	w	Complete sprint
`GET`	`/api/planner/sprints/{id}/burndown`	r	Sprint burndown
`GET`	`/api/planner/projects/{id}/views`	r	List saved views
`POST`	`/api/planner/projects/{id}/views`	w	Create saved view
`GET`	`/api/planner/views/{id}`	r	Get saved view
`PUT`	`/api/planner/views/{id}`	w	Update saved view
`DELETE`	`/api/planner/views/{id}`	w	Delete saved view
`PUT`	`/api/planner/projects/{id}/views/reorder`	w	Reorder saved views
`GET`	`/api/planner/issues/{id}/fields`	r	List custom fields on an issue
`PUT`	`/api/planner/issues/{id}/fields`	w	Upsert custom fields
`DELETE`	`/api/planner/issues/{id}/fields/{key}`	w	Delete a custom field
`GET`	`/api/planner/projects/{id}/field-keys`	r	List custom field keys defined in a project
`GET`	`/api/planner/context`	r	Compact planner context for AI prompts

Pipeline (platform validation)

Method	Path	Auth	Description
`GET`	`/api/pipeline/distros`	r	Available test distros
`POST`	`/api/pipeline/run`	w	Run a validation suite (infra / network / security / backup / drift)

Backups

Requires: modules.backups = true

Method	Path	Auth	Description
`GET`	`/api/backup-jobs`	r	List backup jobs
`POST`	`/api/backup-jobs`	w	Create backup job
`GET`	`/api/backup-jobs/{id}`	r	Get backup job
`PUT`	`/api/backup-jobs/{id}`	w	Update backup job
`DELETE`	`/api/backup-jobs/{id}`	w	Delete backup job
`POST`	`/api/backup-jobs/{id}/run`	w	Trigger manual backup
`GET`	`/api/backup-jobs/{id}/records`	r	List backup records
`POST`	`/api/backup-jobs/{id}/records/{rid}/restore`	w	Restore from a record
`GET`	`/api/backup-jobs/{id}/records/{rid}/download`	r	Download an archive
`POST`	`/api/backup-jobs/{id}/records/{rid}/verify`	w	Verify a record's checksum

Project Registry (manual project records)

Method	Path	Auth	Description
`GET`	`/api/projects`	r	List projects (filters: tag, status, has_stack, q, include=system)
`POST`	`/api/projects`	w	Create project
`GET`	`/api/projects/{id}`	r	Get project
`PATCH`	`/api/projects/{id}`	w	Partial update
`DELETE`	`/api/projects/{id}`	w	Delete project
`POST`	`/api/projects/{id}/redeploy`	w	Redeploy the linked Portainer stack
`GET`	`/api/projects/{id}/claude-context`	r	Claude-context bundle for AI grounding
`GET`	`/api/projects/local`	r	Scan the master's data volume for git repos

Bookmarks

Method	Path	Auth	Description
`GET`	`/api/bookmarks`	r	List bookmarks
`POST`	`/api/bookmarks`	w	Create bookmark
`GET`	`/api/bookmarks/{id}`	r	Get bookmark
`PUT`	`/api/bookmarks/{id}`	w	Update bookmark
`DELETE`	`/api/bookmarks/{id}`	w	Delete bookmark

Discovery

Method	Path	Auth	Description
`GET`	`/api/discovery`	r	List discovered items (auto-detected services + endpoints)
`GET`	`/api/discovery/bookmarked`	r	List bookmarked discovery items
`POST`	`/api/discovery/{id}/bookmark`	w	Bookmark a discovery item

Notification channels

Method	Path	Auth	Description
`GET`	`/api/notification-channels`	a	List notification channels (Discord, webhook, n8n)
`POST`	`/api/notification-channels`	a	Create channel
`PUT`	`/api/notification-channels/{id}`	a	Update channel
`DELETE`	`/api/notification-channels/{id}`	a	Delete channel
`POST`	`/api/notification-channels/{id}/test`	a	Send a test notification

Favorites

Method	Path	Auth	Description
`GET`	`/api/favorites`	r	List favorites for the current user
`POST`	`/api/favorites`	r	Add a favorite
`DELETE`	`/api/favorites/{type}/{id}`	r	Remove a favorite
`GET`	`/api/favorites/{type}/{id}`	r	Check if a resource is favorited

Environment templates

Method	Path	Auth	Description
`GET`	`/api/env-templates`	r	List env templates
`POST`	`/api/env-templates`	w	Create env template
`GET`	`/api/env-templates/{id}`	r	Get env template
`PUT`	`/api/env-templates/{id}`	w	Update env template
`DELETE`	`/api/env-templates/{id}`	w	Delete env template

Credentials

Method	Path	Auth	Description
`GET`	`/api/credentials`	a	List credentials (encrypted at rest)
`POST`	`/api/credentials`	a	Create credential
`GET`	`/api/credentials/{id}`	a	Get credential
`PUT`	`/api/credentials/{id}`	a	Update credential
`DELETE`	`/api/credentials/{id}`	a	Delete credential

Sub-containers (admin)

Method	Path	Auth	Description
`GET`	`/api/admin/subcontainers`	a	List the cb-* fleet (Headscale, Prometheus, Grafana, n8n, Wazuh, Loki, Tempo, Pyroscope, Ollama, Alertmanager)
`GET`	`/api/admin/subcontainers/{name}`	a	Get a sub-container's status
`GET`	`/api/admin/subcontainers/{name}/health`	a	Health probe
`GET`	`/api/admin/subcontainers/{name}/logs`	a	Recent logs
`POST`	`/api/admin/subcontainers/{name}/restart`	a	Restart
`POST`	`/api/admin/subcontainers/{name}/deploy`	a	Re-deploy via Portainer API
`PUT`	`/api/admin/subcontainers/{name}/config`	a	Update stack config
`DELETE`	`/api/admin/subcontainers/{name}`	a	Remove the stack

App Catalog

Requires: modules.catalog = true

Method	Path	Auth	Description
`GET`	`/api/catalog`	r	List templates
`GET`	`/api/catalog/categories`	r	List categories
`POST`	`/api/catalog`	w	Create custom template
`GET`	`/api/catalog/{id}`	r	Get template details
`PUT`	`/api/catalog/{id}`	w	Update template
`DELETE`	`/api/catalog/{id}`	w	Delete template

Proxy Routes

Requires: modules.proxy_routes = true

Method	Path	Auth	Description
`GET`	`/api/proxy-routes`	r	List proxy routes
`POST`	`/api/proxy-routes`	a	Create route
`PUT`	`/api/proxy-routes/{id}`	a	Update route
`DELETE`	`/api/proxy-routes/{id}`	a	Delete route

Webhooks

Requires: modules.webhooks = true

Method	Path	Auth	Description
`GET`	`/api/webhook-targets`	a	List targets
`POST`	`/api/webhook-targets`	a	Create target
`PUT`	`/api/webhook-targets/{id}`	a	Update target
`DELETE`	`/api/webhook-targets/{id}`	a	Delete target
`POST`	`/api/webhook-targets/{id}/test`	a	Fire a test webhook against the target

Discord (optional)

Method	Path	Auth	Description
`GET`	`/api/discord/status`	a	Bot connection + guild status
`GET`	`/api/discord/commands`	a	Registered slash commands
`GET`	`/api/discord/agents`	a	Bot-side agent state
`GET`	`/api/discord/activity`	a	Recent bot activity
`POST`	`/api/discord/test`	a	Send a test message to a configured channel
`POST`	`/api/discord/simulate`	a	Inject a synthetic event into the bot's handler

Settings + module config

Method	Path	Auth	Description
`GET`	`/api/settings/{key}`	a	Read a CB setting
`PUT`	`/api/settings/{key}`	a	Write a CB setting
`GET`	`/api/config/{module}`	a	Read live module config
`PUT`	`/api/config/{module}`	a	Write live module config

Other

Method	Path	Auth	Description
`GET`	`/api/notifications`	r	List notifications
`POST`	`/api/notifications/test`	w	Test the notification dispatcher
`GET`	`/api/audit`	a	List audit entries
`GET`	`/api/analytics`	r	Query analytics events
`GET`	`/api/activity`	r	Recent activity feed
`GET`	`/api/search`	r	Global search (Ctrl+K)
`GET`	`/api/export`	a	Export all configurations
`POST`	`/api/import`	a	Import configurations
`GET`	`/api/topology`	r	Cluster topology graph
`GET`	`/api/integrations/status`	a	Status of every integration (n8n, Wazuh, Headscale, Grafana, …)
`GET`	`/api/system/info`	a	Master system info
`GET`	`/api/health-checks`	r	Health-check definitions
`GET`	`/api/terminal/ws`	a	Web terminal (WebSocket)

gRPC Services

Worker-to-master communication uses Protocol Buffers. Definitions are in proto/contextbay/v1/.

Service	RPC	Description
`NodeService`	`Register`	Worker sends hardware info, gets node ID
`NodeService`	`Heartbeat`	Periodic health pings with stats
`NodeService`	`ReportMetrics`	Streaming system + container metrics
`NodeService`	`ReportEvents`	Streaming Docker / security events
`CommandService`	`CommandStream`	Bidirectional stream for log + exec session proxying. Container CRUD goes through Portainer, not gRPC.

WebSocket Events

Connect to /api/ws for real-time events. Events are JSON objects:

{"type": "node.status", "payload": {"node_id": "abc", "status": "healthy"}}
{"type": "container.update", "payload": {"id": "xyz", "state": "running"}}
{"type": "alert.fired", "payload": {"id": "alert-1", "severity": "warning"}}
{"type": "notification", "payload": {"title": "Backup complete", "body": "..."}}