Token-free reads
GET /api/state returns the full Hub snapshot —
agents, events, runs, projects, flows, schedules. GET
/api/stream is the same data live, over SSE. Poll these
freely; never dispatch a run just to check status.
Dispatch & control
POST /api/instruct starts a run. POST
/api/flows, /api/schedules, and
/api/projects manage and trigger flows, clock
schedules, and AI-planned projects.
Plugin wire protocol
POST /v1/agent-events and /v1/agent-events/gate
are how hook relays report tool use and ask permission before
risky calls — fail-open by design, frozen and versioned.
Remote federation
/api/remotes and the /v1/remote/*
routes let one orchestrator pair with another on the same LAN,
guarded by an HMAC handshake — fail-closed for inbound control,
fail-open for local availability.
Full route reference, request/response shapes, and the plugin
protocol details are installed with the product under
docs/ai/http-api.md.