The server refuses to start with authentication required and no credential source configured.
Set
API_KEYS (comma-separated) or API_JWT_SECRET, or API_REQUIRE_AUTH=false for local
work. Rate limits default to 60 requests a minute per key and 30 unauthenticated, reported in
X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset.What is here
Agents
Create, list, inspect and delete agent configurations.
Conversations
Multi-turn chat with an agent, with the transcript kept server-side.
Training
Start a GRPO or other RL training job, poll its status, cancel it.
Messages (Anthropic-compatible)
POST /v1/messages against the configured inference backend; OpenAI-style input accepted.Chat completions (OpenAI-compatible)
POST /v1/chat/completions and GET /v1/models — point an OpenAI SDK at the server.Observability
Health, readiness and liveness probes, Prometheus metrics, circuit-breaker state.
Serving a trained model
The/v1/messages and /v1/chat/completions routes are thin: they forward to whatever
INFERENCE_BACKEND points at — a vLLM server carrying the model you trained — and translate the
request and reply into the shape the caller expects.
"stream": true to either endpoint for server-sent chunks; set
INFERENCE_STREAM_INCLUDE_USAGE=true to have the backend report token usage in the stream when it
supports it.
Errors and versioning
Every error is one envelope:GET /api/docs/errors lists the codes a running server can return, and GET /api/docs/changelog
what changed between its versions. Deprecated routes answer with a Deprecation header carrying
the sunset date.
Not in this reference
- The Training Lab router (
/api/lab/*) — the backend of the separately published dashboard and mobile apps. It is behindAPI_ENABLE_TRAINING_LAB, off by default, and has no deployment path today. - The MCP server and CLI, which wrap the framework rather than this gateway — see MCP server and CLI.
The server’s own OpenAPI leaves twenty-two responses untyped. Nineteen of them are typed here from
the handler that produces them (
spec/overlays/agents.json in the docs repository); the three
that remain — the two DELETEs and GET /v1/models — say so on their pages.