API Surface Overview

Base URL: http://localhost:8080 locally; https://api.<your-domain> behind the Compose domain overlay or a Helm ingress. Identity provider: http://localhost:8180 or https://auth.<your-domain>.
Style: JSON over HTTPS REST, Spring MVC controllers in core/*; streaming endpoints use text/event-stream.
Auth: Keycloak-issued bearer JWT by default; a small, explicit set of paths use other credentials. See Authentication & Authorization.
Scale: 207 @RestController classes under core/**/src/main/java (counted by source scan, 2026-09-26). Not a generated OpenAPI spec: none exists in the repository.

How to read this page

Base paths and controller class names below were extracted from the @RequestMapping annotations in source. Per-endpoint verbs, request and response bodies are documented only on the pages where the controller was read in full (Streaming, Webhooks, Developer API). For every other area consult the controller named in the table.

Conventions

Tenancy. Every authenticated request runs inside a tenant taken from the JWT tenant_id claim (TenantContextFilter); there is no tenant parameter in URLs. Schema-per-tenant isolation is described in Data Architecture & Tenancy.
CORS. Configured in WebConfig from app.web.allowed-origins; X-Session-Id and Content-Disposition are exposed response headers.
Security headers. Core is a pure JSON API: CSP default-src 'none'; frame-ancestors 'none', strict-origin-when-cross-origin referrer policy, restrictive permissions policy (SecurityConfig).
Errors. Mapped centrally by GlobalExceptionHandler (core/app); the full status-code catalogue is not reproduced here.
Session correlation. Agent chat returns the session id in the X-Session-Id response header.

Route map by area

"Ann." is the number of @Get/Post/Put/Patch/DeleteMapping annotations in the named controller(s), per source scan.

Agents and runtime

Base path	Controller	Ann.	Notes
`/api/agents`	`AgentController`	42	CRUD, config patches, memories, tool-calls; `POST /{agentId}/chat` is SSE.
`/api/agents/{agentId}/agui`	`AgUiRunController`	3	AG-UI run, rejoin, tools. See Streaming.
`/api/agents/{agentId}/{schedule,triggers,versions,experiments,quality,share,improvements,guardrails}`	`AgentScheduleController`, `AgentEventTriggerController`, `AgentVersionController`, `AgentExperimentController`, `QualityController` (+ dataset/gate/simulation controllers), `AgentShareOwnerController`, `AgentImprovementController`, `AgentGuardrailController`	—	Per-agent sub-resources.
`/api/a2a`, `/api/agents/{agentId}/a2a`, `/.well-known/agent-card.json`	`A2aJsonRpcController`, `A2aAgentCardController`	2 + 3	A2A JSON-RPC and cards. See Developer API.
`/api/workflows`	`WorkflowController`	30	CRUD, `/run`, runs list/get/cancel/pause/resume, schedule, node webhook, diagram.
`/api/workflows/{id}/{share}`, `/api/workflows/input-requests`, `…/versions`	`WorkflowShareOwnerController`, `WorkflowInputRequestController`, `WorkflowVersionController`	3 / 3 / 5	Sharing, human-input requests, versions.
`/api/approvals`	`ApprovalController`	5	Approval inbox (Postman: list, get, approve, reject).
`/api/briefs`	`BriefController`, `BriefLifecycleController`, `BriefProofController`	8 / 8 / 4	Brief-to-agent planning; `POST /plan` is SSE.
`/api/tools/{code,openapi,scripts,classifications}`, `/api/mcp/registry`, `/api/mcp/registrations`	`CustomCodeToolController`, `OpenApiToolSourceController`, `UserToolScriptController`, `McpRegistryController`, `McpRegistrationTestController`	8 / 10 / 6 / 8 / 2	Tool sources and MCP client registry.

Knowledge, providers and quality

Base path	Controller	Ann.
`/api/knowledge`, `/knowledge/collections`, `/knowledge/connectors`, `/knowledge/jobs`, `/knowledge/ocr-provider`	`KnowledgeController`, `KnowledgeCollectionController`, `KnowledgeConnectorController`, `KnowledgeIngestionJobController`, `OcrProviderConfigController`	8 / 8 / 5 / 1 / 3
`/api/providers`, `/api/capabilities`, `/api/model-pricing`, `/api/completions`	`ProviderController`, `CapabilityController`, `ModelPricingController`, `FimCompletionController`	7 / 6 / 2 / 1
`/api/rl`, `/api/guardrails/rules`, `/api/moderation/review`, `/api/audit-log`	`RlController`, `GuardrailRuleController`, `ModerationReviewController`, `AuditLogController`	7 / 5 / 5 / 2
`/api/code-intel`	`CodeIntelController`	24

Channels and omnichannel

Base path	Controller(s)
`/api/channels/{twilio,telegram,slack,discord,teams,email,meta-whatsapp,meta-social,x}/credential`	`*CredentialController` per channel (BYOK credential writes; admin-gated)
`/api/channels/{whatsapp,telegram,slack,discord,teams,email,social,x}` send routes, `/api/channels/voice`, `/pairing`, `/contacts`, `/routing`, `/status`, `/health`	`WhatsAppSendController`, `TelegramSendController`, `SlackSendController`, `VoiceChannelController`, `ChannelPairingController`, `ChannelContactController`, `ChannelRoutingController`, `ChannelStatusController`, `ChannelHealthController` and siblings
`/api/handoff`, `/api/leads`, `/api/email/messages`	`OperatorInboxController`, `LeadController`, `EmailMessageController`
`/webhook/**` (inbound)	See Webhooks & Callbacks

Tenant, billing and administration

Base path	Controller(s)
`/api/signup`, `/api/me`, `/api/account`, `/api/session`, `/api/auth/social-providers`	`TenantSignupController`, `MeController`, `AccountController`, `SessionConfigController`, `SocialAuthConfigController`
`/api/tenant/{settings,sso,subscription,upgrade,invoices,billing-profile,resolutions,data-export,data-deletion,data-usage,feature-flags,referral,trial,branding}`	`TenantSettingsController`, `TenantSsoController`, `TenantSubscriptionController`, `TenantUpgradeController`, `InvoiceController`, `ResolutionController`, `TenantDataController`, `TenantDataUsageController` and siblings
`/api/payments`, `/api/budget/top-up`, `/api/commerce/feed`, `/api/tenant/commerce/products`	`PaymentController`, `BudgetTopUpController`, `ProductFeedController`, `ProductCatalogController`
`/api/admin/{users,templates,llm-usage,spend-reports,issues}`, `/scim/v2`	`UserAdminController`, `AdminTemplateController`, `LlmCallLogController`, `SpendReportController`, `PlatformIssueController`, `ScimProvisioningController`
`/api/platform/**` (platform-admin only)	`PlatformController` (48 ann.), `AbuseMonitorController`, `ModerationController`, `PlanLimitsController`, `PlatformToolCredentialController`, `TenantDeletionController`, `NewsletterController`, `DemoSandboxController`
`/api/secrets`, `/api/webhooks`, `/api/mcpserver/grants`, `/api/dev/v1`	`SecretVaultController`, `WebhookSubscriptionController`, `McpServerAccessController`, `DeveloperApiController`

Public, anonymous and device surfaces

Base path	Credential	Controller(s)
`/api/demo/**`	`X-Demo-Token` header (sandbox)	`DemoSessionController`, `DemoChatController`, `DemoStudioController`, `DemoChannelController`, `DemoMagicController`, media demo controllers
`/api/share/agents/`, `/api/share/workflows/`	Unguessable share id	`AgentShareController`, `WorkflowShareController` (+ voice/vision siblings)
`/api/devices/`, `/api/edge/`	Keycloak JWT or `X-Device-Token`, per route	`DeviceGatewayController`, `DeviceDataIngestionController`, `DeviceController`, `EdgeToolExecutionController`, `EdgeAgentsConfigController`
`/api/public/status`, `/api/system/status/live`, `/api/public/landing-event`, `/api/templates/gallery`, `/api/plugins/catalog`	None	`PublicStatusController`, `SystemStatusController`, `LandingEventController`, `TemplateGalleryController`, `PluginCatalogController`

Deployment shape

Specific controllers are gated by Spring profiles: security (JWT resource server, billing, admin), mcpserver (/mcp, /api/dev/v1), and the fail-closed default !insecure security chain. Profile behaviour and the split into app/worker/jobs entry points is covered in System Architecture.

Where to go next

Authentication & Authorization — tokens, the permitAll list, role and permission gates.
Streaming: SSE & AG-UI — chat stream framing, AG-UI events, resume.
Webhooks & Callbacks — inbound channel/payment/workflow hooks and outbound subscriptions.
Developer API & MCP Server — API keys, /api/dev/v1, /mcp, A2A.

Evidence & references

core/**/src/main/java/**/*Controller.java — 207 @RestController classes; base paths from @RequestMapping.
core/security/src/main/java/com/agenticai/core/security/SecurityConfig.java — security headers, filter chains.
core/app/src/main/java/com/agenticai/core/common/WebConfig.java — CORS.
web/app/api-reference/page.tsx and web/app/lib/api-reference-data.ts — public API-reference page, API_BASE_PUBLIC.
Agentic-AI-Platform.postman_collection.json — Postman collection (health, signup, token, admin, providers, agents, approvals, MCP registry, knowledge, audit, channels).