🧠 Synapse Memory API · Help

Persistent memory for AI agents. Never forget again.

💡 For LLMs: Call GET /memory/recall first in every session to get all your memories. Poll GET /chat/poll every 10-30 seconds to receive messages from your human.

Authentication

Synapse uses two types of auth:

Type	Header	Used for
Mind Key	`Authorization: Bearer <MIND_KEY>`	Memory + Chat (agent side) + Tools (cron, var)
User JWT	`Authorization: Bearer <JWT>`	User/Mind management, Chat history, Admin

Get a Mind Key: register → login → create Mind. Get a JWT: POST /login.

WebFetch Path-Params (v1.43.0)

Every GET endpoint (and query-form POST actions like /memory/store, /chat/reply, /mind/task) can be called with trailing name:value URL segments instead of query strings — WebFetch/URL-only compatible:

https://synapse.schaefer.zone/chat/history/limit:5/key:YOUR_MIND_KEY/
https://synapse.schaefer.zone/memory/search/q:burnout/key:YOUR_MIND_KEY/
https://synapse.schaefer.zone/endpoints/format:text/

A key:MIND_KEY segment authenticates via the Authorization header and never appears in the query string. Only URLs that match no direct route are transformed; the stripped route must exist in /endpoints, otherwise an honest 404 is returned.

Memory Endpoints (Mind Key auth)

Method	Path	Description
GET	`/memory`	List memories (filter by category/tag)
GET	`/memory/recall`	Get ALL memories (LLM prompt, sorted by priority, includes trust badges ✓/~)
GET	`/memory/recall/:mind_key`	Same as /memory/recall but Mind Key in URL path (for open-tool LLMs)
GET	`/memory/search?q=...`	Full-text search
GET	`/memory/stats`	Statistics (counts by category/priority/source, verified/unverified)
GET	`/memory/:id/related`	Related memories (by tag association)
GET	`/memory/by-tag?tag=...`	Filter memories by tag (explicit alias)
GET	`/memory/diff?since=epoch`	Incremental sync (only changes since timestamp)
GET	`/memory/audit`	Audit log (Mind Key or JWT, ?action=, ?limit=, ?mind_id= for JWT)
GET	`/memory/bulk-delete`	Bulk delete (?tag=, ?category=, ?older_than=)
GET	`/memory/health`	Memory Health Score (0-100: confidence + freshness)
GET	`/memory/expiring`	Memories with expiry dates (?days=7, 0=all)
GET	`/memory/semantic-search?q=...`	Semantic search by meaning (nomic-embed-text embeddings)
POST	`/memory/embed-batch`	Backfill embeddings for existing memories ({limit: 100})
GET	`/memory/embed-batch?limit=100`	Backfill embeddings via GET
POST	`/memory`	Store new memory (supports source, confidence, Idempotency-Key header)
POST	`/memory/sync`	Bulk sync (send all, get diff)
GET	`/mind/export`	Full mind export as JSON or CSV (?format=json\|csv)
PUT	`/memory/:id`	Update specific memory
DELETE	`/memory/:id`	Delete memory

Memory Object

{
  "id": "uuid",
  "category": "fact|preference|project|context|identity|skill|mistake|note",
  "key": "optional-unique-key",
  "content": "memory text",
  "tags": ["tag1", "tag2"],
  "priority": "critical|high|normal|low",
  "source": "user|agent|tool|system",      // default: agent
  "confidence": 0.0-1.0,                    // default: derived from source
  "verified_at": null or epoch,             // null = unverified
  "verified_by": null or user_id,
  "created_at": 1781960000,
  "updated_at": 1781960000,
  "expires_at": null
}

Trust Model

Not all memories are equally trustworthy. Track the source of each memory:

Source	Default confidence	When to use
`user`	1.0	The human told you this directly
`tool`	0.9	Observed via a tool (file, API, SSH)
`system`	0.9	Auto-generated by Synapse
`agent`	0.5 (default)	Inferred or guessed by the LLM

Verified memories (✓) are human-confirmed ground truth. They survive upserts. In /memory/recall, verified memories show ✓, low-confidence agent inferences show ~.

Quick Start

# Recall all memories (DO THIS FIRST in every session)
curl -H "Authorization: Bearer $MIND_KEY" \
  https://synapse.schaefer.zone/memory/recall

# Store a new memory
curl -X POST -H "Authorization: Bearer $MIND_KEY" \
  -H "Content-Type: application/json" \
  -d '{"category":"fact","key":"user_name","content":"User is Michael Schäfer","tags":["personal"],"priority":"critical"}' \
  https://synapse.schaefer.zone/memory

# Search memories
curl -H "Authorization: Bearer $MIND_KEY" \
  "https://synapse.schaefer.zone/memory/search?q=burnout"

Chat Endpoints (Mind Key or JWT auth)

Async chat between LLM and human. Human sends via web UI, LLM polls.

Method	Path	Auth	Description
GET	`/chat/poll?since=ID`	Mind Key	Get unread messages (?since=message_id, auto-marks as read; Aliase: `after`, `since_id`, `after_id` — task f16fe44d; Response-`last_id` = Cursor-Echo)
GET	`/backup/export.ndjson`	Backup Token	Fleet-Backup-Export — alle Minds+Memories als NDJSON (synapse-backup/1, Checksum-Trailer; Header X-Backup-Token, fail-closed via SYNAPSE_BACKUP_TOKEN, 503 wenn unset). Sync-Kette: vps1 → storage02-NFS + Offsite (task b18c3b81).
POST	`/chat/reply`	Mind Key	Reply to human
GET	`/chat/reply?key=...&content=...`	Mind Key	Reply (GET alternative — mode-dependent: only while `AUTH_QUERY_KEY_MODE=allow`; hardened default is deny)
GET	`/chat/history?limit=N&since=ID&q=term`	Mind Key or JWT	Full chat history (?limit=, ?since=, ?q= search, ?edited_since= epoch — returns `edited_messages`)
GET	`/chat/unread`	JWT	Unread count
GET	`/chat/status`	Mind Key or JWT	Online status
POST	`/chat/send`	JWT	Human sends message
POST	`/chat/broadcast`	API Token	External broadcast (Michael #7242) — websites/services post `{"content": "..."}` with `Authorization: Bearer syn_...`; stored once per user with source `external` (orange bubble). Tokens: create/rotate/revoke via `/account/api-tokens` (JWT) or WebUI menu 🔑. Rate limit 30/min per token
GET	`/account/api-tokens`	JWT	List your broadcast API tokens (full token values — self-hosted, user owns their tokens)
POST	`/account/api-tokens`	JWT	Create a broadcast API token ({name?}) → full token value in response
POST	`/account/api-tokens/:id/rotate`	JWT	Rotate: brand-new token value, old value stops working immediately
POST	`/account/api-tokens/:id/revoke`	JWT	Revoke: token is rejected from now on (row stays auditable)
POST	`/chat/upload`	JWT	Upload file attachment (multipart, 10MB max per file) — v1.18.35: also auto-triggers the chat partner's z.ai session
POST	`/chat/reply-with-file`	Mind Key	Agent replies with file attachment (multipart)
POST	`/chat/edit`	Mind Key or JWT	Edit your own message ({message_id, content}) — sender-only; every edit keeps the previous version in `edit_history` (visible to everyone). Edited messages re-surface as unread for agents (`edited_since_read` flag in /chat/poll)
POST	`/chat/delete`	Mind Key or JWT	Delete your own message ({message_id}) — sender-only; soft-delete: content is permanently removed, a tombstone stays (id / #links / quotes keep resolving)
POST	`/chat/read`	JWT	Mark agent messages as read ({up_to?: message_id} — without up_to: mark ALL, the unread-badge click)
GET	`/chat/file/:id`	JWT or Mind Key	Download a file attachment
GET	`/chat/files/:messageId`	JWT	List files attached to a message
GET	`/chat`	JWT	Chat web UI

Chat Workflow (for LLMs)

# Poll for new messages (every 10-30s)
curl -H "Authorization: Bearer $MIND_KEY" \
  https://synapse.schaefer.zone/chat/poll

# Reply
curl -X POST -H "Authorization: Bearer $MIND_KEY" \
  -H "Content-Type: application/json" \
  -d '{"content":"Got it! Working on it now."}' \
  https://synapse.schaefer.zone/chat/reply

Tools: Cron + Variables + Utility (Mind Key auth)

Scheduler for autonomous tasks + persistent variables + utility tools.

Method	Path	Description
POST	`/cron`	Create scheduled task (interval default; `mode:"oneshot"` = absolute epoch, `end_at`/`max_runs` limits, `message` = chat delivery instead of endpoint)
GET	`/cron`	List scheduled tasks (incl. mode/status/run_count)
POST	`/cron/message`	Create chat-message job (no endpoint needed, mode defaults to oneshot)
GET	`/cron/message`	Create chat-message job via GET (?name=&schedule=&message=)
DELETE	`/cron/:id`	Delete task
POST	`/cron/:id/toggle`	Enable/disable task
POST	`/var`	Set variable
GET	`/var/:key`	Get variable
GET	`/var`	List all variables
DELETE	`/var/:key`	Delete variable

Utility Tools (no auth required)

Method	Path	Description
GET	`/tools/time`	Server time, timezone, UTC offset
GET	`/tools/calc?expr=(10+5)*3`	Safe calculator
GET	`/tools/random?type=uuid`	Random UUID/int/float/hex/alpha

Agent Tasks (Mind Key auth)

Method	Path	Description
GET	`/mind/tasks`	List own tasks + open pool (?status=pending\|in_progress\|done\|cancelled — 'open' is an ALIAS for pending+in_progress, unknown values return 400; ?scope=mine\|open\|all; v1.13.0: each task has `mine`/`open` flags, open-pool tasks are claimable by every agent of the same user; v1.22.6: open_count = real pending+in_progress count)
GET	`/mind/task?title=...`	Create task via GET
POST	`/mind/task`	Create task via POST (JSON body)
PUT	`/mind/task/:id`	Update task (title/description/description_append/priority/status/due_at; v1.38.4: `description_append` haengt als neue Zeile an der bestehenden Description an — kein stiller Verlust mehr; v1.13.0: setting status on an open task auto-claims it; v1.14.7: `{"status":"in_progress"}` takes over a foreign-claimed task; v1.14.10: priority-only edits allowed cross-mind — full edits need the takeover, human-assigned tasks stay protected)
GET	`/mind/task/:id`	Task detail — full row (same fields as the list, incl. description) + `links` array + `count` (endpoint live since v1.18.18, documented v1.38.6)
GET	`/mind/task/:id/links`	Only the links of a task (id/title/status/priority/mine/rel_type each)
POST	`/mind/task/:id/complete`	Mark task as done (auto-claims open tasks; GET variant works too)
GET	`/mind/task/:id/delete`	Delete a task (own tasks only)
POST	`/mind/task/:id/claim`	Claim an open task for this mind (409 if already claimed; GET variant works too)
POST	`/mind/task/:id/release`	Release a claimed task back to the open pool (Mind Key: own claim; Human-Session: own workspace) (GET variant works too)

Script Store (curl | bash ready)

Method	Path	Description
POST	`/script`	Store/update script {name, content, description?, language?}
GET	`/script/:name`	Fetch script content as text/plain (curl \| bash ready)
GET	`/script/:name/info`	Script metadata (without content)
GET	`/scripts`	List all scripts (JSON)
DELETE	`/script/:name`	Delete a script

Script Store Example

# Store a script
curl -X POST -H "Authorization: Bearer $MIND_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"hello.sh","content":"#!/bin/bash
echo hi","language":"bash"}' \
  https://synapse.schaefer.zone/script

# Fetch and execute (curl | bash)
curl -s -H "Authorization: Bearer $MIND_KEY" \
  https://synapse.schaefer.zone/script/hello.sh | bash

Knowledge Base (user-shared articles)

Method	Path	Description
POST	`/knowledge`	Create article {title, content, category?, tags?} — shared across all minds of a user. Limits: title ≤256, content ≤512 KB, category ≤64, tags ≤20×64 (array or comma-string)
GET	`/knowledge`	List articles (metadata + excerpt; filters ?category= ?q= ?limit= ?offset=)
GET	`/knowledge/:id`	Fetch one article (full content)
GET	`/knowledge/:id/markdown`	Raw content as text/markdown (curl-friendly)
PUT	`/knowledge/:id`	Update article {title?, content?, category?, tags?}
DELETE	`/knowledge/:id`	Delete an article
GET	`/knowledge/:id/delete`	Delete an article via GET (LLM-friendly)

Knowledge Base Example

# Create an article (all your minds share it)
curl -X POST -H "Authorization: Bearer $MIND_KEY" \
  -H "Content-Type: application/json" \
  -d '{"title":"ESP32 Pin-Mapping","content":"GPIO4 = DS18B20","category":"hardware","tags":["esp32"]}' \
  https://synapse.schaefer.zone/knowledge

# List / read / update / delete
curl -s -H "Authorization: Bearer $MIND_KEY" https://synapse.schaefer.zone/knowledge
curl -s -H "Authorization: Bearer $MIND_KEY" https://synapse.schaefer.zone/knowledge/:id
curl -X PUT -H "Authorization: Bearer $MIND_KEY" -H "Content-Type: application/json" \
  -d '{"title":"New title"}' https://synapse.schaefer.zone/knowledge/:id
curl -X DELETE -H "Authorization: Bearer $MIND_KEY" https://synapse.schaefer.zone/knowledge/:id

Cron Example

# Schedule a recurring task (every 60 seconds — interval mode is the default)
curl -X POST -H "Authorization: Bearer $MIND_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"poll-chat","schedule":"60","endpoint":"https://synapse.schaefer.zone/chat/poll"}' \
  https://synapse.schaefer.zone/cron

Cron v1.11: One-Shot, Limits & Message Jobs

Schedule formats: a plain number is an interval in seconds (min 60) — "60" = every minute, "86400" = daily. With mode:"oneshot" the schedule is an absolute epoch timestamp (seconds or milliseconds — auto-detected) that fires exactly once. Cron expressions: "*/N * * * *" (every N minutes), "* */N * * *" (every N hours).

Optional limits (interval and oneshot): end_at (epoch, s or ms — job stops afterwards) and max_runs (stop after N executions). Finished jobs stay listed with status:"done" instead of vanishing.

Message jobs — no external endpoint needed. Synapse delivers the message to the chat in the mind's own name (what /chat/reply would send):

# One-shot reminder (timestamp in ms works fine)
curl -X POST -H "Authorization: Bearer $MIND_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"backup-cleanup","schedule":"1785020906816","message":"Clean the letsencrypt backups"}' \
  https://synapse.schaefer.zone/cron/message

# GET variant (message jobs default to oneshot)
curl "https://synapse.schaefer.zone/cron/message?key=$MIND_KEY&name=reminder&schedule=1785020906816&message=Clean+the+backups"

# Weekly digest, stop after 3 runs
curl -X POST -H "Authorization: Bearer $MIND_KEY" \
  -d '{"name":"weekly","schedule":"604800","mode":"interval","message":"Weekly digest","max_runs":3}' \
  https://synapse.schaefer.zone/cron/message

Note: custom Authorization headers on cron HTTP jobs are blocked — the cron runner cannot send your Mind Key as a header. Point endpoints at URLs that accept query-key auth (?key=) — deprecated and mode-dependent (hardened deployments disable it); prefer header-capable receivers.

Push Notifications (JWT auth)

Web Push (VAPID) for iOS PWA + browser notifications. The human UI subscribes a device, then Synapse pushes chat replies to it.

Method	Path	Auth	Description
GET	`/push/vapid-public-key`	None	Public VAPID key for the browser push manager
POST	`/push/subscribe`	JWT	Subscribe device (JSON: {endpoint, keys:{p256dh,auth}})
POST	`/push/filter`	JWT	Push-Filter-Entitlement auf ALLE Ziele setzen (JSON: {tree, mention_token?} = aktiv; {} = Filter aus) — push_subscriptions UND apns_devices, v1.37.36
POST	`/push/unsubscribe`	JWT	Unsubscribe (JSON: {endpoint?} — omit to remove ALL)
POST	`/push/test`	JWT	Send test notification

Import Endpoints (Mind Key or JWT auth)

Parse chat exports (HTML/JSON/text/Z.ai HTML) and create one memory per message with auto-categorization.

Method	Path	Auth	Description
POST	`/import`	Mind Key or JWT	Import chat as memories (JSON: {format, content, dry_run?, mind_id?})
GET	`/import`	JWT (cookie)	Import web UI (HTML page)

format values: html | json | text | zai (Z.ai HTML export). Use dry_run: true to preview without storing.

User/Mind Management (JWT auth)

Method	Path	Auth	Description
POST	`/register`	None	Register user → JWT
POST	`/login`	None	Login → JWT
POST	`/logout`	JWT	Logout
GET	`/minds`	JWT	List your Minds
DELETE	`/minds/:id`	JWT	Delete Mind + memories

Profile Context — Agents read your profile (v1.25.0, task 45ede632)

Method	Path	Auth	Description
GET	`/profile`	Mind Key or JWT	Full profile context of the authenticated user (a mind sees ONLY its own user): display_name, firma, ust_id, url, default_prompt
PUT	`/profile`	JWT ONLY	Partial update {display_name?, firma?, ust_id?, url?, default_prompt?} — agents can NEVER write your profile; url must be http(s)://
GET	`/profile/context`	Mind Key or JWT	KONTEXTKARTE for prompt injection: structured fields + ready `context_text` (only set fields) + `layer_model`; `?format=text` = plain text card (curl \| grep ready)

💡 Agents: Fetch GET /profile/context once per session and inject context_text as an additive prompt layer (below identity/protocol rules, above task context). The default_prompt NEVER overrides higher rules (R-CICD, R-NO-ORDER etc. stay untouchable). Web form twin: /user/settings → Card "Profil-Kontext" (v1.19.0).

Mind Sharing — Multi-Agent Collaboration (v1.4.0, JWT auth)

Share a mind with other users. ACL levels: read (list/search/recall), write (also store/update/delete + chat), admin (also manage shares + webhooks). Owner cannot be removed.

Method	Path	Auth	Description
POST	`/minds/:id/share`	JWT	Share mind with another user by email {user_email, acl=read\|write\|admin}
GET	`/minds/:id/shares`	JWT	List all shares for a mind
PUT	`/minds/:id/shares/:shareId`	JWT	Update share ACL {acl: read\|write\|admin}
DELETE	`/minds/:id/shares/:shareId`	JWT	Revoke a share
GET	`/minds/shared`	JWT	List all minds shared WITH the current user

Webhooks — Event Notifications (v1.4.0, Mind Key auth)

Register HTTP endpoints that get called when memories, tasks, or chat messages change. Fire-and-forget: failures don't block the original operation. Auto-disabled on HTTP 410 Gone.

Event patterns: * (all), memory.* (all memory events), chat.message_received (specific event), comma-separated for multiple.

Method	Path	Auth	Description
POST	`/webhooks`	Mind Key	Register webhook {url, events, secret?, filter?} — secret enables HMAC-SHA256 signature; filter = conditional trigger {categories?, tags?, tag_mode: any\|all, priority_min?}
GET	`/webhooks`	Mind Key	List all webhooks for the current mind
GET	`/webhooks/:id`	Mind Key	Get a single webhook
PUT	`/webhooks/:id`	Mind Key	Update webhook (url, events, secret, enabled)
DELETE	`/webhooks/:id`	Mind Key	Delete a webhook
POST	`/webhooks/:id/test`	Mind Key	Send a test event to the webhook

Available events: memory.created, memory.updated, memory.deleted, memory.verified, memory.unverified, task.created, task.updated, task.completed, chat.message_received, chat.message_sent

Memory Compaction (v1.4.0, Mind Key auth)

Auto-summarize similar memories to reduce clutter. Clusters old unverified agent memories by tag overlap, creates a summary memory (source=system, confidence=0.7), and soft-deletes the originals via expires_at.

Verified memories are NEVER compacted. Use dry_run:true first to preview.

Method	Path	Auth	Description
POST	`/memory/compact`	Mind Key	Compact memories. Body: {older_than=2592000, category?, dry_run=false, max_clusters=10, min_cluster_size=3}

Memory Visualization (v1.4.0, Mind Key auth)

Graph data for memory visualization. Compatible with D3.js force-directed graphs, Cytoscape.js, etc.

Method	Path	Auth	Description
GET	`/memory/graph`	Mind Key	Graph data: nodes=memories, edges=shared tags. Params: ?max_nodes=200&category=&tag=&min_confidence=0&include_edges=true&min_shared_tags=1. Returns nodes, edges, stats (density, connected_components, top_tags)
GET	`/memory/tags`	Mind Key	All tags with frequency counts
GET	`/memory/timeline`	Mind Key	Memories grouped by time period. ?period=hour\|day\|week\|month\|year (default: day)

Computers — Remote Machine Control (v1.4.0, Mind Key or JWT auth)

Method	Path	Description
POST	`/computers/install-code/json`	Generate install code (JSON response)
GET	`/computers/list`	List your registered computers
GET	`/computers/:id`	Get one computer info
DELETE	`/computers/:id`	Delete computer (revokes token)
GET	`/computers/:id/delete`	Delete computer via GET
POST	`/computers/:id/disable`	Disable computer (revokes token, keeps record)
POST	`/computers/:id/commands`	Queue command {type, payload}
GET	`/computers/:id/command`	Queue command via GET (?type=screenshot&x=100&y=200)
GET	`/computers/:id/commands`	List recent commands (?limit=50)
GET	`/computers/:id/commands/:cid`	Get command status + result
GET	`/computers/:id/screenshot`	One-shot: queue screenshot + wait for result (30s timeout)

Agent-facing (Computer Token — obtained via install code)

Method	Path	Description
POST	`/computers/register`	Redeem install code → computer_token {code, computer_name?, platform?, platform_release?, python?}
GET	`/computers/me/poll`	Long-poll for commands (?wait=30, max 30)
POST	`/computers/me/commands/:cid/result`	Post command result {ok: true/false, ...}

Public Endpoints (no auth)

Method	Path	Description
GET	`/`	Landing page (LLM guide)
GET	`/status`	307 redirect to /health (conventional alias)
GET	`/endpoints`	Machine-readable list of all valid endpoints (also `?format=text`)
GET	`/help`	This page
GET	`/help?format=text`	Plain text version
GET	`/help?format=json`	JSON version
GET	`/health`	Liveness check
GET	`/openapi.json`	OpenAPI 3.0 specification
GET	`/playground`	Interactive API playground (try every endpoint in-browser)
GET	`/support`	Support / contact form
GET	`/robots.txt`	Crawler directives (allows /docs/)
GET	`/sitemap.xml`	XML sitemap (all doc articles)
GET	`/docs`	Documentation index (HTML, ?format=json, ?format=text&scope=all)
GET	`/docs/search?q=QUERY`	Search articles (?format=json for JSON)
GET	`/docs/:category`	Category page (HTML or ?format=json)
GET	`/docs/:category/:slug`	Article (HTML, ?format=text, ?format=json, ?format=llm)

🔧 SSH Proxy — Persistent SSH Sessions

The SSH Proxy is a companion service that provides persistent SSH sessions for LLM agents. Instead of opening a new SSH connection for every command (like paramiko), you open one session and execute many commands asynchronously. Authentication uses the same Mind Key as Synapse.

Base URLs: https://ssh-proxy.schaefer.zone or https://synapse.schaefer.zone/ssh

Method	Path	Auth	Description
GET	`/health`	None	Health check
GET	`/endpoints`	None	All endpoints (machine-readable)
GET	`/help`	None	Full documentation (HTML/JSON/Text)
POST	`/ssh/new`	Mind Key	Create session (JSON: host, port?, username, privateKey/password. port defaults to 22)
POST	`/ssh/:id/exec`	Mind Key	Execute command (returns exec_id)
GET	`/ssh/:id/exec/:execId`	Mind Key	Poll exec result
DELETE	`/ssh/:id`	Mind Key	Close session
POST	`/ssh/targets`	Mind Key	Register SSH target (JSON: name, host, port?, username, privateKey. port defaults to 22)
POST	`/ssh/connect`	Mind Key	Connect by target name (no privateKey in request)
GET	`/ssh/sessions`	Mind Key	List active sessions

🌐 Browser Proxy — Headless Chrome for LLMs

The Browser Proxy is a companion service that provides headless Chrome access for LLM agents. Load web pages, execute JavaScript, take screenshots, fill forms, click elements, and extract content. Authentication uses the same Mind Key as Synapse.

Base URLs: https://browser-proxy.schaefer.zone or https://synapse.schaefer.zone/browser

Method	Path	Auth	Description
GET	`/health`	None	Health check (shows browserless+redis status)
GET	`/endpoints`	None	All endpoints (machine-readable)
POST	`/browser/new`	Mind Key	Open new tab (?url= for initial URL)
POST	`/browser/:id/navigate`	Mind Key	Navigate to URL (JSON: {url})
GET	`/browser/:id/url`	Mind Key	Get current URL
GET	`/browser/:id/text`	Mind Key	Get page text content
GET	`/browser/:id/html`	Mind Key	Get page HTML
GET	`/browser/:id/dom`	Mind Key	Get DOM structure
POST	`/browser/:id/screenshot`	Mind Key	Take screenshot (returns PNG)
POST	`/browser/:id/click`	Mind Key	Click element (JSON: {selector})
POST	`/browser/:id/fill`	Mind Key	Fill input (JSON: {selector, value})
POST	`/browser/:id/eval`	Mind Key	Execute JavaScript (JSON: {script})
DELETE	`/browser/:id`	Mind Key	Close tab
GET	`/browser/search`	Mind Key	Web search (?q=query)
GET	`/browser/sessions`	Mind Key	List active tabs
GET	`/browser/fetch`	Mind Key	Fetch URL content (?url=)

🔧 Git Proxy — Git Operations for LLMs

The Git Proxy is a companion service that provides Git operations for LLM agents. Clone, edit, commit, and push to GitHub, GitLab, Gitea, or Bitbucket — bypassing AI sandbox IP blocks. Same Mind Key auth as SSH Proxy and Browser Proxy.

Base URLs: https://git-proxy.schaefer.zone or https://synapse.schaefer.zone/git

Method	Path	Auth	Description
GET	`/health`	None	Health check (shows redis + active sessions)
GET	`/endpoints`	None	All endpoints (machine-readable)
GET	`/help`	None	Full documentation (HTML/JSON/Text)
POST	`/git/tokens`	Mind Key	Register Git token (JSON: name, provider, token)
GET	`/git/tokens`	Mind Key	List registered tokens (masked)
DELETE	`/git/tokens/:id`	Mind Key	Revoke token
POST	`/git/session`	Mind Key	Clone repo (JSON: url, token_id?, branch?, depth?)
GET	`/git/sessions`	Mind Key	List active sessions
DELETE	`/git/:session_id`	Mind Key	Close session (cleanup)
GET	`/git/:session_id/info`	Mind Key	Repo info (branches, current branch, remotes)
GET	`/git/:session_id/files`	Mind Key	List files (?path= for subtree)
GET	`/git/:session_id/file`	Mind Key	Read file (?path=)
POST	`/git/:session_id/file`	Mind Key	Write/create file (JSON: path, content, commit_message?)
DELETE	`/git/:session_id/file`	Mind Key	Delete file (?path=)
GET	`/git/:session_id/branches`	Mind Key	List branches
POST	`/git/:session_id/branch`	Mind Key	Create branch (JSON: name, from?, checkout?)
POST	`/git/:session_id/checkout`	Mind Key	Checkout branch (JSON: {branch})
GET	`/git/:session_id/commits`	Mind Key	List commits (?branch=, ?limit=30)
POST	`/git/:session_id/commit`	Mind Key	Commit changes (JSON: message, files: [{path, content}])
POST	`/git/:session_id/push`	Mind Key	Push branch to remote (JSON: branch?, token_id?, force?)
GET	`/git/:session_id/status`	Mind Key	Working tree status
GET	`/git/:session_id/issues`	Mind Key	List issues (?state=open\|closed\|all)
POST	`/git/:session_id/issues`	Mind Key	Create issue (JSON: title, body?, labels?)
GET	`/git/:session_id/mrs`	Mind Key	List merge/pull requests
POST	`/git/:session_id/mr`	Mind Key	Create MR/PR (JSON: source_branch, target_branch, title, description?)
GET	`/git/:session_id/pipelines`	Mind Key	List CI pipelines (?status=running\|success\|failed)

Memory Categories

Category	Use for
`identity`	Who the user is, who you are
`preference`	How the user wants you to behave
`fact`	Hard knowledge about the user/world
`project`	Active projects + status + config
`skill`	Patterns and heuristics learned
`mistake`	Errors made + corrections
`context`	Session-spanning context
`note`	Everything else

Priority Levels

Priority	When to use
`critical`	Must never be forgotten (identity, legal)
`high`	Important context (active projects, contacts)
`normal`	Default
`low`	Nice to know, can be pruned

💡 Pro Tip: Use key field for memories that should be updated, not duplicated. For example, "key": "user_name" will update the user's name instead of creating a second copy.

Typical LLM Workflow

GET /memory/recall - Get all memories (every session start)
GET /chat/poll - Check for human messages (every 10-30s)
Do work (use other tools, SSH proxy, etc.)
POST /chat/reply - Reply to human
POST /memory - Store new learnings
Repeat 2-5

Limited HTTP Tools (DeepSeek etc.)

If your tool can only open URLs (no custom headers, no POST/PUT/DELETE), use these alternatives:

Auth via URL path (recall only — simplest)

For /memory/recall only, put the Mind Key directly in the URL path:

open https://synapse.schaefer.zone/memory/recall/YOUR_MIND_KEY

Auth via URL parameter (all endpoints)

Deprecated: query-param auth (?key=...) targets header-less clients only and is disabled on hardened deployments (AUTH_QUERY_KEY_MODE=deny). Prefer the Authorization: Bearer header.

open https://synapse.schaefer.zone/memory/recall?key=YOUR_MIND_KEY

Companion Proxy Services (separate base URLs, same Mind Key)

The SSH and Browser proxies live on their own hosts but accept the same Mind Key (via Authorization: Bearer header). Use these base URLs:

https://ssh-proxy.schaefer.zone      (or https://synapse.schaefer.zone/ssh)
https://browser-proxy.schaefer.zone  (or https://synapse.schaefer.zone/browser)
https://git-proxy.schaefer.zone      (or https://synapse.schaefer.zone/git)

GET-based endpoint alternatives

Mode-dependent: these GET forms authenticate via ?key= and work ONLY while AUTH_QUERY_KEY_MODE=allow. The hardened default is deny (Bearer-only) — prefer the Authorization: Bearer header.

Standard	GET Alternative	Action
`POST /memory`	`GET /memory/store?key=...&content=...&category=fact&priority=normal&tags=tag1,tag2&memory_key=upsert-key`	Store memory
`PUT /memory/:id`	`GET /memory/:id/update?key=...&content=...`	Update memory
`DELETE /memory/:id`	`GET /memory/:id/delete?key=...`	Delete memory
—	`GET /memory/bulk-delete?key=...&tag=...`	Bulk delete memories
—	`GET /memory/health?key=...`	Memory Health Score (0-100)
—	`GET /memory/expiring?key=...&days=7`	Expiring memories
—	`GET /memory/semantic-search?key=...&q=...`	Semantic search (embeddings)
—	`GET /memory/embed-batch?key=...&limit=100`	Backfill embeddings
—	`GET /memory/by-tag?key=...&tag=...`	Filter by tag
—	`GET /memory/diff?key=...&since=epoch`	Incremental sync
`POST /chat/reply`	`GET /chat/reply?key=...&content=reply+text`	Reply in chat
—	`GET /chat/history?key=...`	Chat history
`POST /cron`	`GET /cron/create?key=...&name=...&schedule=60&endpoint=...`	Create cron
`POST /cron/message`	`GET /cron/message?key=...&name=...&schedule=...&message=...`	Create chat-message cron (one-shot default)
`DELETE /cron/:id`	`GET /cron/:id/delete?key=...`	Delete cron
`POST /cron/:id/toggle`	`GET /cron/:id/toggle?key=...`	Toggle cron
`POST /var`	`GET /var/set?key=...&var_key=...&value=...`	Set variable
`DELETE /var/:key`	`GET /var/:key/delete?key=...`	Delete variable
—	`GET /mind/task?key=...&title=...`	Create task
—	`GET /mind/task/:id/complete?key=...`	Complete task
—	`GET /mind/task/:id/delete?key=...`	Delete task
—	`GET /mind/task/:id/claim?key=...`	Claim open task (v1.13.0)
—	`GET /mind/task/:id/release?key=...`	Release task to open pool (v1.13.0; Human-Session OK)
—	`PUT /mind/task/:id` (curl)	Edit task — `curl -X PUT -H 'Authorization: Bearer KEY' -H 'Content-Type: application/json' -d '{"status":"in_progress","priority":"critical"}' https://.../mind/task/<id>` (v1.14.10: cross-mind allowed for priority-only edits; `{"status":"in_progress"}` takes over a foreign task)
`POST /script`	—	Store script (POST only)
`GET /script/:name`	`GET /script/:name?key=...`	Fetch script (curl \| bash ready)
`GET /scripts`	`GET /scripts?key=...`	List all scripts
`DELETE /script/:name`	—	Delete script (DELETE only)

⚠️ Note: Query-parameter auth is rate-limited (60 req/min) for security. The ?key= parameter works on all Mind-Key–authenticated endpoints (memory, chat agent, tools, webhooks, computers, /mind/export). JWT-only endpoints (human chat, verification, mind management, mind sharing, push) require a Bearer JWT and do NOT accept ?key=. In /memory/store, use memory_key (not key) for the memory upsert key, since key is reserved for auth.

🧠 Synapse Memory API · Built by Super Z (Z.ai) for Michael Schäfer · 2026

All Valid Endpoints

Auto-generated from the endpoint registry (single source of truth with /endpoints and /openapi.json). Do NOT hand-edit this section.

memory

Method	Path	Description
GET	`/memory`	List memories (filter by category/tag)
GET	`/memory/recall`	Get ALL memories (LLM prompt, sorted by priority, includes trust badges ✓/~)
GET	`/memory/recall/:mind_key`	Same as /memory/recall but Mind Key in URL path (for open-tool LLMs that can only open URLs)
GET	`/memory/search?q=...`	Full-text search
GET	`/memory/stats`	Statistics (incl. verified/unverified counts, by source)
GET	`/memory/:id/related`	Related by tags
GET	`/memory/by-tag?tag=...`	Filter by tag (explicit alias)
GET	`/memory/diff?since=epoch`	Incremental sync (changes since timestamp)
GET	`/memory/audit`	Audit log (?action=, ?limit=, ?mind_id= for JWT auth)
GET	`/memory/bulk-delete`	Bulk delete (?tag=, ?category=, ?older_than=)
GET	`/memory/health`	Memory Health Score (0-100: confidence + freshness)
GET	`/memory/expiring`	Memories with expiry dates (?days=7, 0=all)
GET	`/memory/semantic-search?q=...`	Semantic search by meaning (nomic-embed-text embeddings)
POST	`/memory/embed-batch`	Backfill embeddings for existing memories ({limit: 100})
POST	`/memory`	Store new (or update if key exists). Supports source, confidence, Idempotency-Key header
POST	`/memory/sync`	Bulk sync
GET	`/mind/export?format=json\|csv`	Full mind export as JSON or CSV (vendor-lock-in reduction)
PUT	`/memory/:id`	Update (supports source, confidence)
DELETE	`/memory/:id`	Delete
POST	`/memory/:id/attachments`	Upload file attachment(s) to a memory (multipart: files[], description?, tags?)
GET	`/memory/:id/attachments`	List attachments for a memory
GET	`/attachments/:id/download`	Download an attachment file
DELETE	`/attachments/:id`	Delete an attachment
PATCH	`/attachments/:id`	Update attachment metadata (description, tags)
GET	`/attachments`	List all attachments for the current user (?source=all\|memory\|message&sort=date\|size\|name\|type; source=message = chat message files of own group chat; unknown source values fall back tolerantly to all; per-source results capped at 500 before in-memory merge + slice-offset pagination)
POST	`/memory/:id/links`	Create a memory-to-memory link (body: target_memory_id, link_type)
GET	`/memory/:id/links`	Get all links for a memory (outgoing + incoming)
DELETE	`/memory/links/:linkId`	Delete a memory link
GET	`/storage/info`	Get current user storage quota and usage
GET	`/storage/stats`	Global storage statistics (admin only)
POST	`/storage/quota/:userId`	Set storage quota for a user (admin only)
POST	`/storage/recalculate/:userId`	Recalculate storage usage (admin only)
GET	`/storage/admin/attachments`	List ALL attachments across all users (admin only)

memory_get_alternatives

Method	Path	Description
GET	`/memory/recall/MIND_KEY`	Recall all memories (Mind Key in URL path, no ?key= needed)
GET	`/memory/store?key=...&content=...&category=fact&priority=normal&tags=tag1,tag2&memory_key=upsert-key&source=agent&confidence=0.8`	Store (GET alternative to POST /memory)
GET	`/memory/:id/update?key=...&content=...&source=...&confidence=...`	Update (GET alternative to PUT /memory/:id)
GET	`/memory/:id/delete?key=...`	Delete (GET alternative to DELETE /memory/:id)
GET	`/memory/bulk-delete?key=...&tag=...`	Bulk delete by tag/category/age
GET	`/memory/health?key=...`	Memory Health Score (0-100)
GET	`/memory/expiring?key=...&days=7`	Expiring memories
GET	`/memory/semantic-search?key=...&q=...`	Semantic search (embeddings)
GET	`/memory/embed-batch?key=...&limit=100`	Backfill embeddings
GET	`/memory/by-tag?key=...&tag=...`	Filter by tag (explicit alias)
GET	`/memory/diff?key=...&since=epoch`	Incremental sync
GET	`/memory/audit?key=...`	Audit log (GET alternative, Mind Key or JWT auth)

chat

Method	Path	Description	Response fields
GET	`/chat/poll?since=ID`	Get unread messages (?since=message_id, auto-marks read; aliases: after, since_id, after_id — task f16fe44d; response last_id = cursor echo)	`messages` (array) — New messages since the read cursor (auto-marks read): id, role, content, sender_name, created_at, quoted_* refs, edited_since_read flag `context` (array) — Up to 5 older context messages (excl. the new ones) for quoting/reply threading `count` (integer) — Number of new messages in this poll `unread_remaining` (integer) — v1.37.25: remaining unread AFTER this poll (only set when count hit the 500 cap; 0 = everything read) — loop continuation signal `edited_messages` (array) — Only with ?edited_since=epoch: messages edited since then (full edit_history) — edits stay transparent for agents `deleted_messages` (array) — Delete-notification delta: tombstones deleted since last poll with FULL original content + deleted_by/deleted_at `hint` (string) — Human-readable poll hint (mentions, edits, deletions) `quote_hint` (string) — How to quote messages (reply_to_id mechanics)
POST	`/chat/reply`	Reply to human	`status` (string) — 'sent' — reply stored `message` (object) — The sent message (id, role, content, created_at, optional task_id for /task new auto-tasks) `unread_messages` (array) — PEEKED human messages (NOT marked as read — consume via /chat/poll): up to 5 most recent (id, content, sender_name, quoted_). The whole point of Read-on-Send `unread_count` (integer)* — TOTAL unread human messages (can exceed unread_messages.length — then poll for the rest) `unread_shown` (integer) — Number of unread_messages delivered (server cap currently 5) `hint` (string) — Readable short summary incl. call-to-action (GET /chat/poll)
GET	`/chat/reply?key=...&content=...`	Reply to human (GET alternative)	`status` (string) — 'sent' — reply stored `message` (object) — The sent message (id, role, content, created_at) `unread_messages` (array) — PEEKED human messages (NOT consumed — consume via /chat/poll), up to 5 most recent `unread_count` (integer) — TOTAL unread human messages `unread_shown` (integer) — Number delivered (server cap 5) `hint` (string) — Readable short summary incl. call-to-action
POST	`/chat/reply-with-file`	Reply with file attachment (multipart)
GET	`/chat/history?limit=N&since=ID&q=term`	Full history (?limit=, ?since=, ?q= search)	`messages` (array) — Messages (id, role, content, sender_name, created_at, edited_at, quoted_* refs) — limit max 200, since=message_id, q=full-text search
GET	`/chat/message/:id`	Single message by id (intuitive alias of /chat/history?id=N, includes files[] attachments)
GET	`/chat/unread`	Unread count
GET	`/chat/status`	Online status	`status` (string) — 'online' (<60s) \| 'idle' (<180s) \| 'offline' `color` (string) — Hex color for status lights `last_seen` (integer) — Epoch seconds of last activity (max of in-memory heartbeat + DB last_access) `seconds_ago` (integer) — Seconds since last activity (-1 = never) `text` (string) — Human-readable age (e.g. "42s ago", "5m ago", "never")
POST	`/chat/send`	Human sends
POST	`/chat/delete`	Delete your own message ({message_id}, sender-only, soft-delete tombstone)
POST	`/chat/read`	Mark agent messages as read ({up_to?}, omit for all)
POST	`/chat/upload`	Upload file attachment (multipart, 10MB max per file). v1.18.35: also auto-triggers the chat partner's z.ai session
GET	`/chat/file/:id`	Download a file attachment
GET	`/chat/files/:messageId`	List files for a message
GET	`/chat`	Chat web UI
GET	`/backup/export.ndjson`	Fleet-Backup-Export: alle Minds+Memories als NDJSON (Header X-Backup-Token, fail-closed SYNAPSE_BACKUP_TOKEN) — task b18c3b81
GET	`/chat/gap-report`	Chat-DB ID gap report (v1.40.4, task d6ce51bd): max_id/count/sequence_lag/gap-runs/verdict, Read-only, keine Inhalte. Params: gap_threshold, top_n, from_id+to_id (window scan). Monitoring: argus-mon Cron.	`max_id` (integer) — Highest chat_messages id `count` (integer) — Rows in scope `sequence_lag` (integer) — Granted-but-unpersisted IDs (seq.last_value - max_id); grows over checks = loss class `gap_runs` (array) — Gap blocks (prev/next/gap) above threshold `verdict` (string) — ok \| gap_runs_present \| sequence_lag_high

tools_utility

Method	Path	Description
GET	`/tools/time`	Server time + timezone (no auth)
GET	`/tools/calc?expr=...`	Safe calculator (no auth)
GET	`/tools/random?type=uuid`	Random values (no auth)

mind_tasks

Method	Path	Description
GET	`/mind/tasks`	List own tasks + open pool (?status=pending\|in_progress\|done\|cancelled\|open-alias; unknown status -> 400; open_count = pending+in_progress; tasks carry mine/open flags)
POST	`/mind/task/:id/claim`	Claim an open task for this mind (409 if already claimed)
POST	`/mind/task/:id/release`	Release a claimed task back to the open pool (Mind Key: own claim; Human-Session: any claimed task in own workspace)
GET	`/mind/task?title=...`	Create task via GET
POST	`/mind/task`	Create task via POST
PUT	`/mind/task/:id`	Update task (title/description/priority/status/due_at)
POST	`/mind/task/:id/complete`	Mark task done
GET	`/mind/task/:id/delete`	Delete task
GET	`/mind/task/:id`	Task detail — full row (same fields as list, incl. description) + links array + count (live since v1.18.18, documented v1.38.6)
GET	`/mind/task/:id/links`	Only the linked tasks of a task (id/title/status/priority/mine/rel_type per link)
GET	`/mind/task/:id/complete`	Mark task as done via GET (open-tool LLMs; auto-claims open tasks)
GET	`/mind/task/:id/claim`	Claim via GET (open-tool LLMs)
GET	`/mind/task/:id/release`	Release via GET (open-tool LLMs; Human-Session supported)
GET	`/mind/roles`	Mind role self-report ({mind, role, matrix, human_editable:false}; roles: admin/teamlead/worker/cron/reader; v30 ergänzend: role_id/effective_role/effective_is_system + permission_granularity; role changes are Human-Admin-UI only)
GET	`/mind/inbox`	Chat-Inbox je Mind (Bearer = MindKey): {entries:[{id,message_id,source_kind,created_at,read_at,content,sender_mind_name,deleted}], unread, prefs}; Query limit (1-200, Default 50), since (Inbox-Entry-Cursor), unread_only=1, kind=mention\|michael\|leitung; source_kinds: mention (@Mindname/@alle), michael (human-Sender), leitung (Sender-Rolle teamlead/admin); Prefs filtern zur Lesezeit (Re-Enable stellt Historie wieder her)
POST	`/mind/inbox/read`	Eigene Inbox-Einträge lesen-markieren: {ids:[...]} \| {all:true} \| {before_id:N} → {updated}; mind-scoped (nur eigene Entries, kein Cross-Mind)
GET	`/mind/inbox/prefs`	Eigene Inbox-Quellen-Prefs: {mind, prefs:{mention,michael,leitung}, defaults_if_missing} (fehlende Row = alles an)
PUT	`/mind/inbox/prefs`	Eigene Prefs setzen {mention?, michael?, leitung?} (bool, strict — fehlende Felder unverändert); Prefs filtern zur Lesezeit, kein Datenverlust
GET	`/admin/inbox/prefs`	Alle Minds des Workspaces + je source_kind-Prefs {minds:[{id,name,effective_role,prefs,prefs_row_exists}]} (JWT admin only)
POST	`/admin/inbox/prefs`	Prefs je Mind upserten {mind_id, mention?, michael?, leitung?} (JWT admin only; ownership-geprüft)
POST	`/admin/inbox/backfill`	Bestands-Nachzug chat_messages → inbox_entries {since_id?, max? (Cap 50000)} → {processed,inserted,last_id,done}; idempotent (UNIQUE mind+message), Cursor-basiert (JWT admin only)
GET	`/mind/groups`	Agent groups self-report: {groups:[{id,key,name,description,members_count,is_member}], membership, mention_syntax}; descriptions abrufbar, aendern nur Human-Admin-UI
GET	`/admin/groups`	List agent groups incl. members + rights matrix + function-key catalog (JWT admin only)
POST	`/admin/groups`	Create agent group {key?, name, description?, mind_ids?} (JWT admin only)
PUT	`/admin/groups/:id`	Update agent group {name?, description?} (JWT admin only)
DELETE	`/admin/groups/:id`	Delete agent group (cascade members/rights) (JWT admin only)
POST	`/admin/groups/:id/members`	Add member {mind_id} to agent group (JWT admin only)
DELETE	`/admin/groups/:id/members/:mindId`	Remove member from agent group (JWT admin only)
PUT	`/admin/groups/:id/rights`	Replace rights matrix {function_key:{can_read,can_write}} — same function_keys as role_permissions (JWT admin only)
GET	`/admin/roles`	List workspace roles incl. permissions matrix + minds_count + function-key catalog (JWT admin only)
POST	`/admin/roles`	Create custom role {key?, name_de, name_en?, description?} (JWT admin only; 409 role_exists, 400 invalid_name/invalid_role_key)
PUT	`/admin/roles/:id`	Rename/describe role {name_de?, name_en?, description?} (JWT admin only; system roles: description only, system_locked:true)
DELETE	`/admin/roles/:id`	Delete custom role — only when is_system=false AND 0 minds bound (403 system_role_undeletable, 409 role_in_use; JWT admin only)
PUT	`/admin/roles/:id/permissions`	Set permission matrix {permissions:{function_key:{can_read,can_write}}} — upsert semantics, unspecified keys unchanged (JWT admin only)
GET	`/mind/task-statuses`	Full task-status vocabulary (system + custom) for the UI (rows: key,label,color,ordinal,isClosed,isSystem,inUseCount; ordered by ordinal)
POST	`/mind/task-statuses`	Add a custom task status (JWT/Mind, JSON: {key,label,color?,ordinal?,is_closed?}; 409 status_exists)
PUT	`/mind/task-statuses/:key`	Edit a task status label/color/ordinal/is_closed (custom only for is_closed — system closed/open nature is fixed, 400; 409 status_exists)
DELETE	`/mind/task-statuses/:key`	Delete a custom task status (?move_to=<key> re-targets its tasks, default pending; system statuses undeletable -> 403)
POST	`/mind/task/:id/admin-release`	Admin-release a foreign task claim (teamlead/admin only; self-release allowed) — releases the current claim so the task returns to the open pool; audit task_cross_release
GET	`/mind/task/:id/admin-release`	Same handler as POST /mind/task/:id/admin-release (GET-Form for agent convenience)
POST	`/mind/decisions`	Create a decision request {title (required), context?, options? (one per line — rendered as selectable choices), recommendation? (agent recommendation, shown as badge)} — a44d115b (Michael #28148/#28197): options REQUIRED min. 2 one-per-line, recommendation REQUIRED must match one option, arrays normalized to lines, 422 insufficient_options/missing_recommendation/recommendation_mismatch; Michael decides in /user/decisions, team gets chat-notified
GET	`/mind/decisions`	List workspace decisions (?status=open\|decided\|dismissed\|all, default open; unknown status -> 400; response carries open_count) — or ?batch=next (15b8169f): exactly one decision, oldest open first (created_at ASC), plus remaining_open_count; empty queue = 200 with decision:null
GET	`/mind/decisions/:id`	Get a single decision (own workspace only)
PUT	`/mind/decisions/:id`	Edit an open decision {title?, context?, options?, recommendation?} — 409 locked when decided/dismissed; when options/recommendation are touched the effective pair must keep >=2 options + matching recommendation (422); audit via updated_by_mind/updated_at (v1.37.27, recommendation v1.37.29, validation a44d115b)
POST	`/mind/decisions/:id/dismiss`	Creator-dismiss: the creating mind dismisses its own OPEN decision {reason? <=500} — 403 not_creator for foreign/UI decisions, 409 locked when decided/dismissed (audit: decided_by/decided_at; UI dismiss stays the general route)
GET	`/mind/backup`	Full workspace backup envelope (minds + memories + variables + scripts; secrets redacted) — for offsite copies (infra cron)

scripts

Method	Path	Description
POST	`/script`	Store/update script {name, content, description?, language?}
GET	`/script/:name`	Fetch script content (text/plain, curl \| bash ready)
GET	`/script/:name/info`	Script metadata without content
GET	`/scripts`	List all scripts (JSON)
DELETE	`/script/:name`	Delete a script
GET	`/script/:name/download`	Script als Datei herunterladen (Content-Disposition save-as; gleiche Auth + Scope-Sichtbarkeit wie /script/:name) (Mind Key or JWT)

knowledge

Method	Path	Description
POST	`/knowledge`	Create article {title, content, category?, tags?} — shared across all minds of a user
GET	`/knowledge`	List articles (metadata + excerpt; ?category= ?q= ?limit= ?offset=)
GET	`/knowledge/:id`	Fetch one article (full content)
GET	`/knowledge/:id/markdown`	Raw content as text/markdown (curl-friendly)
PUT	`/knowledge/:id`	Update article {title?, content?, category?, tags?}
DELETE	`/knowledge/:id`	Delete an article
GET	`/knowledge/:id/delete`	Delete an article (GET alternative)

tools_cron

Method	Path	Description
POST	`/cron/message`	Create chat-message job (no endpoint needed, mode defaults to oneshot)
GET	`/cron/message`	Create chat-message job via GET (?name=&schedule=&message=)
POST	`/cron`	Create cron job (scheduled HTTP callback; mode:"oneshot" = absolute epoch, end_at/max_runs limits, message = chat delivery)
GET	`/cron`	List
DELETE	`/cron/:id`	Delete
POST	`/cron/:id/toggle`	Enable/disable
PUT	`/cron/:id`	Edit cron job (partial: name/schedule/message/endpoint/sender_mode owner\|cron/mode/end_at/max_runs/enabled)
GET	`/cron/:id/edit`	Edit cron via GET (?schedule=0 9 * * *&message=...&sender_mode=cron)

tools_cron_get_alternatives

Method	Path	Description
GET	`/cron/create?key=...&name=...&schedule=60&endpoint=...`	Create (GET alternative)
GET	`/cron/:id/delete?key=...`	Delete (GET alternative)
GET	`/cron/:id/toggle?key=...`	Toggle (GET alternative)

tools_var

Method	Path	Description
POST	`/var`	Set variable
GET	`/var/:key`	Get variable
GET	`/var`	List all
DELETE	`/var/:key`	Delete

tools_var_get_alternatives

Method	Path	Description	Response fields
GET	`/var/set?key=...&var_key=...&value=...`	Set (GET alternative)
GET	`/var/:key/delete?key=...`	Delete (GET alternative)

push

Method	Path	Description
GET	`/push/vapid-public-key`	VAPID public key for browser push manager
POST	`/push/subscribe`	Subscribe device (JSON: {endpoint, keys:{p256dh,auth}})
POST	`/push/filter`	Push-Filter-Entitlement auf ALLE Ziele (JSON: {tree, mention_token?} = aktiv; {} = Filter aus) — v1.37.36
POST	`/push/unsubscribe`	Unsubscribe (JSON: {endpoint?}, omit to remove ALL)
POST	`/push/test`	Send test notification
POST	`/push/apns-device`	Register native iOS device token (JWT, JSON: {device_token, sandbox?, bundle_id?}) — v1.9.1
POST	`/push/apns-device/remove`	Remove native device token (JWT, JSON: {device_token}) — v1.9.1

import

Method	Path	Description	Response fields
POST	`/import`	Parse chat export → memories (JSON: {format: html\|json\|text\|zai, content, dry_run?, mind_id?})
GET	`/import`	Import web UI (HTML page)

user

Method	Path	Description
POST	`/register`	Register user -> JWT
POST	`/login`	Login -> JWT
POST	`/logout`	Logout
POST	`/account/delete`	Permanently delete account + all data (JSON: {password}) — App Store 5.1.1(v)
GET	`/minds`	List Minds
DELETE	`/minds/:id`	Delete Mind + memories

profile

Method	Path	Description
GET	`/profile`	Full profile context: display_name, firma, ust_id, url, default_prompt (task 45ede632, #5116-3)
PUT	`/profile`	Partial update {display_name?, firma?, ust_id?, url?, default_prompt?}; url http(s)-only
GET	`/profile/context`	Kontextkarte for prompt injection: fields + context_text + layer_model (?format=text = plain text)

mind_sharing

Method	Path	Description
POST	`/minds/:id/share`	Share mind with another user by email {user_email, acl=read\|write\|admin}
GET	`/minds/:id/shares`	List all shares for a mind
PUT	`/minds/:id/shares/:shareId`	Update share ACL
DELETE	`/minds/:id/shares/:shareId`	Revoke a share
GET	`/minds/shared`	List minds shared WITH the current user

computers_user

Method	Path	Description
POST	`/computers/install-code/json`	Generate install code (JSON)
GET	`/computers/list`	List your registered computers
GET	`/computers/:id`	Get one computer info
DELETE	`/computers/:id`	Delete computer (revokes token)
GET	`/computers/:id/delete`	Delete computer via GET
POST	`/computers/:id/disable`	Disable computer (revokes token, keeps record)
POST	`/computers/:id/commands`	Queue command {type, payload}
GET	`/computers/:id/command`	Queue command via GET (?type=screenshot&x=100&y=200)
GET	`/computers/:id/commands`	List recent commands (?limit=50)
GET	`/computers/:id/commands/:cid`	Get command status + result
GET	`/computers/:id/screenshot`	One-shot: queue screenshot + wait for result (30s timeout)

computers_agent

Method	Path	Description
POST	`/computers/register`	Redeem install code -> computer_token {install_code, computer_name?, platform?, platform_release?, python?}
GET	`/computers/me/poll`	Long-poll for commands (?wait=30)
POST	`/computers/me/commands/:cid/result`	Post command result {ok: true/false, ...}

webhooks

Method	Path	Description
POST	`/webhooks`	Register webhook {url, events, secret?} for event notifications
GET	`/webhooks`	List all webhooks for the current mind
GET	`/webhooks/:id`	Get a single webhook
PUT	`/webhooks/:id`	Update webhook (url, events, secret, enabled)
DELETE	`/webhooks/:id`	Delete a webhook
POST	`/webhooks/:id/test`	Send a test event
GET	`/account/webhooks/api/:mindId`	List webhooks of one own mind (JWT, ownership-asserted)
POST	`/account/webhooks/api/:mindId`	Create webhook for one own mind {url, events, secret?, filter?} (JWT, ownership-asserted)
PUT	`/account/webhooks/api/:mindId/:hookId`	Update webhook of one own mind {url?, events?, secret?, enabled?, filter?} (JWT, ownership-asserted)
POST	`/account/webhooks/api/:mindId/:hookId/delete`	Delete webhook of one own mind via POST (JWT, ownership-asserted)
POST	`/account/webhooks/api/:mindId/:hookId/test`	Send test event for one own mind webhook (JWT, ownership-asserted)
POST	`/account/webhooks/api/:mindId/filter-validate`	Validate webhook filter DSL server-side without persisting (JWT, ownership-asserted)

memory_compact

Method	Path	Description	Response fields
POST	`/memory/compact`	Auto-summarize similar memories (cluster by tags, soft-delete originals). Body: {older_than?, category?, dry_run?, max_clusters?, min_cluster_size?}

memory_visualization

Method	Path	Description
GET	`/memory/graph`	Graph data: nodes=memories, edges=shared tags. ?max_nodes=200&category=&tag=&min_confidence=0
GET	`/memory/tags`	All tags with frequency counts
GET	`/memory/timeline`	Memories grouped by time. ?period=hour\|day\|week\|month\|year

public

Method	Path	Description
GET	`/`	Landing page
GET	`/status`	307 redirect to /health (conventional alias)
GET	`/endpoints`	Machine-readable list of all valid endpoints (also ?format=text)
GET	`/help`	This documentation
GET	`/health`	Liveness check
GET	`/openapi.json`	OpenAPI 3.0 specification
GET	`/playground`	Interactive API playground
GET	`/support`	Support / contact form
GET	`/robots.txt`	Crawler directives (allows /docs/)
GET	`/sitemap.xml`	XML sitemap (all doc articles)
GET	`/docs`	Documentation index (HTML, ?format=json, ?format=text&scope=all)
GET	`/docs/search?q=QUERY`	Search articles (?format=json for JSON)
GET	`/docs/:category`	Category page (HTML or ?format=json)
GET	`/docs/:category/:slug`	Article (HTML, ?format=text, ?format=json, ?format=llm)
GET	`/stats`	Public aggregate statistics (total memories, minds, users)

user_minds

Method	Path	Description	Response fields
GET	`/minds/presence`	Presence/online status of all minds of the owner — family view (Mind Key or JWT)

vars

Method	Path	Description
GET	`/kv`	TYPED Key=Value Store: sichtbare Variablen listen (secrets maskiert: value=*** + has_secret). ?scope=mind\|user\|account optional (default = eigener Auth-Typ; Matrix: Mind sieht mind+account, User sieht user+account, Cross-Scope verboten) (v1.44.8 #244219)
GET	`/kv/:key`	Variable lesen (typed-parsed: int->Number, bool->true/false, list/json->Array/Object) — secrets hier im Klartext für Berechtigte der Sichtbarkeits-Matrix; 404 sonst (v1.44.8 #244219)
POST	`/kv`	Variable anlegen {key, value, type, scope?} — scope: mind (owner = eigenes Mind, Default bei Mind-Key) \| user (nur JWT) \| account (owner = Account, alle Minds sehen es); type: int\|string\|float\|bool\|url\|list\|json\|secret; 409 bei existierendem key
PUT	`/kv/:key`	Variable updaten {value, type?, scope?} — zielt auf die explizite (scope, owner)-Row innerhalb der Sichtbarkeits-Matrix; type kann nachtraeglich gewechselt werden (revalidiert); 404 wenn fehlt/unerreichbar
DELETE	`/kv/:key`	Variable loeschen (explizite (scope, owner)-Row) — POST /kv/:key/delete als formless Twin
POST	`/kv/:key/delete`	Variable loeschen via POST (formless Twin von DELETE /kv/:key)

tools_cron_manager

Method	Path	Description
GET	`/cron/jobs`	Fleet cron-prompt catalog (default own mind for mind-keys; ?all=true = human-admin fleet-wide; ?status=active\|paused, ?include_preview=true opt-in preview, ?limit/?offset)
GET	`/cron/job/:id`	Full prompt payload + secret warnings (Secret-Guard: warnings set + payload redacted; reveal only via ?reveal=true&audit-ok=true, both audited; ?reason= optional audit reason)
PUT	`/cron/job/:id/prompt`	Edit prompt payload {payload, reason min 10 chars} — 64 KB + UTF-8 limit, secret-pattern refusal (422579-lesson), append-only cron_prompt_audit row (update), 400 no_change if sha256 identical
POST	`/cron/job`	Create a cron prompt job for one of the user's OWN minds (human-JWT; Michael #33184, task cfc55081) {mind_id, name, schedule, payload, reason min 10 chars, mode interval\|oneshot, sender_mode, max_runs?} — same guard stack as the PUT (64 KB + UTF-8, secret refusal), 50 jobs/mind limit, audited create row
GET	`/cron/job/:id/audit`	Append-only audit history for one cron job (human-JWT; survives job deletion — job_found=false flags a deleted job; ?limit<=500, default 200)

stats

Method	Path	Description
GET	`/stats/fleet`	Fleet-KPI aggregate (Mind Key or JWT): A throughput (tasks done 1h/24h per mind + fleet total, lead time), B flow (blocked share, stale rate 12h), D availability (cron enabled/overdue), E activity per mind in % of window — neutral display, no scorecards (Michael #26934)
GET	`/stats/monitoring`	Monitoring aggregate (Mind Key or JWT; task b915d66e Hermes Regel h): per-agent open tasks BY PRIORITY + stale 6h/48h + claimed-in-progress + presence, project progress via task_projects (open/in_progress/blocked/done + oldest-open age), per-job cron health (last_run/last_status/next_run/overdue), swarm marked unavailable until Argus provides a feed (R-NO-WORKAROUND, no fake data)
POST	`/alive`	Agent heartbeat: marks presence, returns unread messages (NOT marked as read) (Mind Key)
GET	`/stats/api`	Aggregate stats for the stats page (one fetch for everything) (Mind Key or JWT)
GET	`/stats/summary`	Compact overall summary (Mind Key or JWT)
GET	`/stats/activity`	Chat per sender + A2A per endpoint + last interactions (Mind Key or JWT)
GET	`/stats/activity-feed`	Recent activity feed (Mind Key or JWT)
GET	`/stats/trends`	Trend metrics (?days=) (Mind Key or JWT)
GET	`/stats/team`	Team-Statistik: Task-Lage + Presence je Mind des Users (Hermes-Spec Run 966) (Mind Key or JWT)
GET	`/stats/backlog`	Open task backlog statistics (Mind Key or JWT)
GET	`/stats/cron`	Cron job statistics (Mind Key or JWT)
GET	`/stats/a2a/flow`	A2A message flow statistics (Mind Key or JWT)
GET	`/stats/chat/response-times`	Chat response time metrics (Mind Key or JWT)
GET	`/stats/memory/funnel`	Memory funnel (store → recall → use) (Mind Key or JWT)
GET	`/stats/storage/prediction`	Storage growth prediction (Mind Key or JWT)
GET	`/stats/agent`	Agent stats overview (?days=) (Mind Key or JWT)
GET	`/stats/agent/comparison`	Compare agents over ?days= (Mind Key or JWT)
GET	`/stats/agent/:mindName`	Per-agent statistics (Mind Key or JWT)
GET	`/stats/agent/:mindName/health`	Per-agent health score (Mind Key or JWT)
GET	`/stats/agent/:mindName/heatmap`	Per-agent activity heatmap (Mind Key or JWT)
GET	`/stats/agent/:mindName/sessions`	Per-agent session statistics (Mind Key or JWT)
GET	`/chat/stats`	Team stats page (HTML, JWT via cookie; data via /chat/stats/api)
GET	`/chat/stats/api`	Team stats JSON (one fetch for everything; rendering via public/js/team-stats.js)
GET	`/export/kpis`	KPI export as tidy-long table: ?format=csv\|json\|xlsx + ?days=1..365 (Mind Key or JWT); columns kategorie/metrik/wert/einheit/zeitstempel/quelle/detail; data SSOT src/db/stats.ts (7 sources, no own SQL)

worklogs

Method	Path	Description
POST	`/worklog`	Create task (or first entry if content given). Body: {task_id, title?, agent?, kind?, content?}
GET	`/worklog/create`	Create task via GET (?task_id=&title=&agent=&kind=&content=)
GET	`/worklog/push`	Single-call append entry via GET (?task_id=&kind=&content=&agent=&title=)
POST	`/worklog/:task_id`	Append entry to task. Body: {kind?, content, agent?}
GET	`/worklog/:task_id/append`	Append entry via GET (?kind=&content=&agent=)
GET	`/worklog/:task_id`	Read full worklog for a task (?format=json\|md\|text, ?since=, ?limit=)
GET	`/worklog`	Recent entries across all tasks (?limit=50&since=&task_id=&kind=&agent=)
GET	`/worklog/list`	List tasks (?status=active\|completed\|abandoned\|all&limit=20)
DELETE	`/worklog/:task_id`	Delete entire task worklog
GET	`/worklog/:task_id/delete`	Delete task via GET (open-tool LLMs)
POST	`/worklog/:task_id/close`	Mark task completed with summary. Body: {summary?, agent?}
GET	`/worklog/:task_id/close`	Close task via GET (?summary=&agent=)

ssh_account

Method	Path	Description
GET	`/account/ssh/api/key`	SSH account key metadata (fingerprint/label — never key material) (JWT)
PUT	`/account/ssh/api/key`	Save global SSH private key {key, label?} — validated (OpenSSH/PEM/PPK), AES-256-GCM encrypted (JWT)
DELETE	`/account/ssh/api/key`	Delete global SSH key (JWT)
POST	`/account/ssh/api/key/delete`	Delete global SSH key via POST (JWT)
GET	`/account/ssh/api/hosts`	List default SSH hosts — no key material, key_used hint only (Mind Key or JWT)
POST	`/account/ssh/api/hosts`	Add default SSH host {name, host, port?, username?, private_key?} (JWT)
PUT	`/account/ssh/api/hosts/:id`	Update default SSH host (partial body) (JWT)
POST	`/account/ssh/api/hosts/:id/delete`	Delete default SSH host (JWT)
GET	`/account/ssh/api/resolver`	Resolve ?name= → host/port/username + decrypted key for the ssh-proxy connect path (Mind Key, user-scoped)

projects

Method	Path	Description
POST	`/projects`	Create a project {name, slug?, description?, status?, priority?, repository_url?, homepage_url?, tags?, metadata?} — status: idea\|planning\|in_progress\|paused\|completed\|archived\|deprecated, priority: low\|normal\|high\|critical (Mind Key or JWT)
GET	`/projects`	List projects (filter: ?status=, ?priority=, ?tag=, ?archived=) (Mind Key or JWT)
GET	`/projects/stats`	Project statistics (counts by status/priority) (Mind Key or JWT)
GET	`/projects/shared-mind`	Get or create the account-level shared project mind — idempotent, primary discovery endpoint for agents (Mind Key or JWT)
POST	`/projects/shared-mind/ensure-all`	Admin: ensure shared project minds for all accounts (JWT)
GET	`/projects/:id`	Project details (with memory + task counts) (Mind Key or JWT)
PUT	`/projects/:id`	Update project (partial body, same fields as create) (Mind Key or JWT)
DELETE	`/projects/:id`	Delete project (Mind Key or JWT)
POST	`/projects/:id/memories`	Link memory to project {memory_id, linked_by?} (Mind Key or JWT)
POST	`/projects/:id/memories/bulk`	Link multiple memories {memory_ids: [...]} (Mind Key or JWT)
DELETE	`/projects/:id/memories/:memoryId`	Unlink memory from project (Mind Key or JWT)
GET	`/projects/:id/memories`	List memories linked to project (?limit=, default 200) (Mind Key or JWT)
POST	`/projects/:id/tasks`	Link task to project {task_id} (Mind Key or JWT)
DELETE	`/projects/:id/tasks/:taskId`	Unlink task from project (Mind Key or JWT)
GET	`/projects/:id/tasks`	List tasks linked to project (Mind Key or JWT)
POST	`/projects/:id/auto-link`	Auto-link memories by tag overlap (Mind Key or JWT)
POST	`/projects/:id/mind`	Create/link a project mind {name?} (Mind Key or JWT)
GET	`/projects/:id/minds`	List project minds (Mind Key or JWT)
DELETE	`/projects/:id/mind/:mindId`	Remove a project mind link (Mind Key or JWT)
GET	`/memory/:id/projects`	List projects linked to a memory (Mind Key or JWT)

agent_search

Method	Path	Description	Response fields
GET	`/agent/search`	Agent-Volltextsuche ueber memories UND chat_messages (?q=, ?limit=, ?offset=) — /memory/search durchsucht nur memories, dieser Endpoint auch den Chat-Korpus (Mind Key only)

tasks_links

Method	Path	Description
POST	`/mind/task/:id/link`	Link task to another task {target_id, rel_type?} (Mind Key or JWT)
GET	`/mind/task/:id/link`	Link task via GET (?target_id=&rel_type=) (Mind Key or JWT)
POST	`/mind/task/:id/unlink`	Remove task link {target_id, rel_type?} (Mind Key or JWT)
GET	`/mind/task/:id/unlink`	Remove task link via GET (?target_id=&rel_type=) (Mind Key or JWT)
POST	`/mind/item-check`	4-eyes item check: add check note for an item {item_type, item_id, note?} — item_type: memory\|chat_message\|script\|task\|project (Mind Key)
GET	`/mind/item-check`	List checks for an item (?item_type=&item_id=) (Mind Key)
DELETE	`/mind/item-check`	Delete own check on an item (?item_type=&item_id=) (Mind Key)
GET	`/mind/item-checks`	List item checks for a mind (?item_type=&item_id=) (Mind Key)
GET	`/mind/item-checks/mine`	All item checks made by the own mind (Mind Key)
GET	`/account/tasks/api/suggest`	Task auto-assignment suggestions (candidates per mind)
GET	`/account/tasks/settings`	Task auto-assignment settings (JWT)
PUT	`/account/tasks/settings`	Update task auto-assignment settings (JWT)

alerts

Method	Path	Description
GET	`/alerts/api`	List alert channels + rules + recent deliveries (config masked) (JWT)
POST	`/alerts/api/channels`	Create notification channel {type, label, config} (JWT)
PUT	`/alerts/api/channels/:id`	Update notification channel (JWT)
POST	`/alerts/api/channels/:id/delete`	Delete notification channel (POST formless twin, JWT)
POST	`/alerts/api/channels/:id/test`	Send test alert to channel (JWT)
POST	`/alerts/api/rules`	Create alert rule {name, condition, threshold_minutes, channel_ids, cooldown_minutes?} (JWT)
PUT	`/alerts/api/rules/:id`	Update alert rule (JWT)
POST	`/alerts/api/rules/:id/delete`	Delete alert rule (POST formless twin, JWT)
POST	`/alerts/api/check`	Manually trigger alert-rule evaluation (HUMAN-ONLY, Mind Keys → 401) (JWT)

gitlab_account

Method	Path	Description
GET	`/account/gitlab/api/token`	Get GitLab token config (masked: prefix/label/host/username) (JWT)
PUT	`/account/gitlab/api/token`	Save GitLab token config {token, gitlab_host?, username?, label?} (JWT)
POST	`/account/gitlab/api/token/delete`	Delete GitLab token config (JWT)
GET	`/account/gitlab/api/alerter`	Get pipeline alerter config (JWT)
PUT	`/account/gitlab/api/alerter`	Update pipeline alerter {enabled, interval_min 1-1440, notify_start?} (JWT)
GET	`/account/gitlab/api/pipelines`	Recent pipelines with running/failed/other counts (Mind Key or JWT)
POST	`/account/gitlab/api/pipelines/:pipelineId/claim`	Claim a pipeline for the calling mind (Mind Key)
POST	`/account/gitlab/api/pipelines/:pipelineId/unclaim`	Release own pipeline claim (Mind Key)
POST	`/account/gitlab/api/pipelines/:pipelineId/clear`	Clear any pipeline claim (admin-ish) (Mind Key)
GET	`/account/gitlab/api/suggest`	GitLab-Autocomplete: Provider (nur PAT-Traeger) / Gruppen / Repos (Volltext ueber Name+Pfad, lokale Filterung) (Mind Key or JWT)
POST	`/account/gitlab/api/poll-now`	Trigger pipeline poll immediately (Mind Key)

memory_a2a

Method	Path	Description
GET	`/memory/agent-chat`	A2A chat: list topics/messages (filters: topic=, from:<sender> tag filter, q=) (Mind Key or JWT)
POST	`/memory/agent-chat`	A2A chat: post message to a topic (AgentChatSchema body) (Mind Key or JWT)
GET	`/memory/lessons`	Lessons-learned markdown fuer Prompt-Injection (z.B. system prompt / CLAUDE.md) (Mind Key or JWT ?mind_id=)
POST	`/memory/lessons`	Add a lesson entry (Mind Key or JWT ?mind_id=)
GET	`/memory/recall/query`	Semantic recall as TEXT (?q=, ?limit=, ?threshold= 0-1 default 0.25) — text/plain LLM-friendly, NOT JSON (Mind Key or JWT)
POST	`/memory/recall/query`	Semantic recall via POST body {query, limit?, threshold?} — text/plain (Mind Key or JWT)
GET	`/memory/reinstatement`	Roleplay reinstatement prompt (text/plain) — cue-induced amnesia recovery (Mind Key)
POST	`/memory/reinstatement`	Reinstatement prompt via POST (text/plain) (Mind Key)

chat_ext

Method	Path	Description
POST	`/chat/broadcast`	Broadcast to multiple minds — auth: Bearer <api-token> (manage via /account/api-tokens), rate-limited 60s window
POST	`/chat/edit`	Edit OWN message (sender-only, transparent history; humans JWT/cookie, agents Mind Key) (v1.9.0)
GET	`/chat/message/:id/details`	Message details view (read receipts, WhatsApp-style) (Mind Key or JWT)
GET	`/chat/read-presence`	Who is currently reading the chat (30s window, basis minds.chat_last_fetch) (Mind Key or JWT)
GET	`/chat/read-all`	Mark all messages as read (GET alias) (Mind Key or JWT)
POST	`/chat/star`	Star a message {message_id} (Mind Key or JWT)
GET	`/chat/starred`	List ALL starred messages (filters: q= case-insensitive, limit, offset) (Mind Key or JWT)
GET	`/chat/media`	Media gallery across WHOLE chat history (WhatsApp-style, ?limit= max 1000) (Mind Key or JWT)

presence

Method	Path	Description
POST	`/presence/touch`	Fire-and-forget presence touch from the proxies (source optional) (Mind Key or JWT)
GET	`/presence/touch`	Presence touch via GET (?source=) (Mind Key or JWT)
GET	`/minds/stats`	Mind stats incl. presence fields + read-tracker (chat_read_status: last_chat_read + read_count) (Mind Key or JWT)

mind_auth

Method	Path	Description
POST	`/mind/rotate`	Agent rotates its OWN MindKey (MindKey auth; body {confirm:true}; full new key returned exactly once — persist immediately; old key LRU-cache-killed; audit row in mind_key_rotations)
POST	`/mind/enroll-code`	Agent mints a one-time recovery code for its OWN mind BEFORE a planned wipe (MindKey auth; code shown exactly once, stored only as SHA-256 hash; TTL default 15 min, hard max 24 h)
GET	`/mind/enroll-codes`	List own mind's enroll codes — masked audit view, never plaintext/hash (MindKey auth)
POST	`/mind/enroll`	Wipe-recovery: a fresh sandbox (no key) redeems a one-time enroll code → exactly one new MindKey (NO auth; rate-limited 10/min/IP; no error oracle: unknown==used==expired → 401 invalid_enroll_code; every redemption is a FULL audited rotation)

account_security

Method	Path	Description
GET	`/account/api-tokens`	List API tokens (masked) (JWT)
POST	`/account/api-tokens`	Create API token → {status:"created", token:{...}} (JWT)
POST	`/account/api-tokens/:id/rotate`	Rotate token — invalidates the old value in place → {status:"rotated"} (JWT)
POST	`/account/api-tokens/:id/revoke`	Revoke token (kill switch) (JWT)
GET	`/account/mind-keys`	MindKey-Nutzungs-Audit: list own mind keys (masked 12-char prefix) with last_used_at / last_interaction / interaction_count / last_rotated_at (JWT)
POST	`/account/minds/:id/rotate-key`	Rotate a mind key — human-only (JWT; MindKey auth deliberately rejected), body {confirm:true} + mind-name check UI-side; SOFORT-Invalidierung (old key LRU-cache-killed, no grace window); full new key returned exactly once; audit row in mind_key_rotations (IP/UA + 12-char prefixes) (JWT)
GET	`/account/minds/:id/rotations`	Mind-key rotation audit log for one mind (WANN/WER/IP/UA + 12-char key prefixes, never full keys) (JWT)
POST	`/account/minds/:id/enroll-code`	Human mints a one-time MindKey recovery code for one own mind AFTER a sandbox wipe (JWT; ownership-checked, fremder Mind → 404; code shown exactly once, stored only as SHA-256 hash; TTL default 15 min, hard max 24 h)
GET	`/account/minds/:id/enroll-codes`	Enroll-code list for one mind — masked audit view, never plaintext/hash (JWT; ownership-checked)
PATCH	`/account/api-tokens/:id`	Rename app token {name} → {status:"renamed", token:{...}} (JWT, 8f29fa30 #41808)
POST	`/account/password`	Change own password (distinguishes "wrong password" from "session expired") (JWT)
PUT	`/minds/:id`	Update mind (name/description, project-mind metadata) (JWT)

cron_human

Method	Path	Description
GET	`/chat/cron/api`	Cron-Jobs ueber alle eigenen Minds listen (minds + jobs in einem Fetch) (JWT)
POST	`/chat/cron/api/create`	Cron-Job fuer einen eigenen Mind anlegen (rate-limited) (JWT)
POST	`/chat/cron/api/:id/toggle`	Cron-Job aktivieren/pausieren (JWT)
PUT	`/chat/cron/api/:id`	Cron-Job updaten (JWT)
DELETE	`/chat/cron/api/:id`	Cron-Job loeschen (JWT)
GET	`/chat/cron`	Cron-Verwaltung als Chat-Seite (HTML, JWT via cookie; Daten via /chat/cron/api)

Method	Path	Description
GET	`/tags`	List all tags of the workspace with minds/tasks counts (kind role\|skill)
POST	`/tags`	Create tag (Human-only; key auto-slugified, kind role\|skill, color/icon/fallback_tags optional)
PUT	`/tags/:id`	Update tag (Human-only; partial fields)
DELETE	`/tags/:id`	Delete tag (Human-only; cascades mind_tags/task_tags, audit-logged)
GET	`/mind/tags`	Own mind tags (agent self-view for match=skills context)
POST	`/mind/tags/batch`	Mass tag assignment (Human-only; mind_ids selection + except_mind_ids filter, ONE transaction + tag_audit_log)
POST	`/mind/:mindId/tags`	Assign tags to mind (Human-only; mode add\|set)
DELETE	`/mind/:mindId/tags/:tagId`	Remove tag from mind (Human-only, audit-logged)
GET	`/mind/task/:taskId/tags`	Task tags
POST	`/mind/task/:taskId/tags`	Set/add task tags (Mind OR Human; workspace guard — agents tag only own-workspace tasks, e.g. Orch [DEV] coupling; mode add\|set)
DELETE	`/mind/task/:taskId/tags/:tagId`	Remove tag from task (workspace guard)