The server refuses to start with authentication required and no credential source configured.
Set
API_KEYS (comma-separated) or API_JWT_SECRET, or API_REQUIRE_AUTH=false for local
work. Rate limits default to 60 requests a minute per key and 30 unauthenticated, reported in
X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset.What is here
The latest source also includes a separate authenticated admin operator surface at/finetune for retained studio runs, capabilities, data/setup inspection, checkpoint and
quality evidence, provider observations, and cooperative local stops. It is documented in
fine-tuning from agents. Those newer
source-derived routes are separate from this generated OpenAPI snapshot and do not launch
training. Discover the deployed capabilities before using them.
Agents
Create, list, inspect and delete agent configurations.
Conversations
Multi-turn chat with an agent, with the transcript kept server-side.
Training
Start a GRPO or other RL training job, poll its status, cancel it.
Messages (Anthropic-compatible)
POST /v1/messages against the configured inference backend; OpenAI-style input accepted.Chat completions (OpenAI-compatible)
POST /v1/chat/completions and GET /v1/models — point an OpenAI SDK at the server.Observability
Health, readiness and liveness probes, Prometheus metrics, circuit-breaker state.
Serving a trained model
The/v1/messages and /v1/chat/completions routes are thin: they forward to whatever
INFERENCE_BACKEND points at — a vLLM server carrying the model you trained — and translate the
request and reply into the shape the caller expects.
"stream": true to either endpoint for server-sent chunks; set
INFERENCE_STREAM_INCLUDE_USAGE=true to have the backend report token usage in the stream when it
supports it.
Errors and versioning
Every error is one envelope:GET /api/docs/errors lists the codes a running server can return, and GET /api/docs/changelog
what changed between its versions. Deprecated routes answer with a Deprecation header carrying
the sunset date.
Not in this reference
- The Training Lab router (
/api/lab/*) — the backend of the separately published dashboard and mobile apps. It is behindAPI_ENABLE_TRAINING_LAB, off by default, and has no deployment path today. - The MCP server and CLI, which wrap the framework rather than this gateway — see MCP server and CLI.
The server’s own OpenAPI leaves twenty-two responses untyped. Nineteen of them are typed here from
the handler that produces them (
spec/overlays/agents.json in the docs repository); the three
that remain — the two DELETEs and GET /v1/models — say so on their pages.