The Workspace talks to its node over plain JSON routes under /api. When sign-in is required, every route needs a session cookie (sign in with a passkey; Users and permissions), and sensitive routes ask for a fresh Face ID. Writes are signed by the node as you, and actions that need approval still need it.
Health and live updates
Route
GET /health
Up or not
GET /api/bootstrap
What the app needs on load
GET /api/events (WebSocket)
Live updates: committed changes and streaming text
Account and devices
Route
GET /api/account
Whether this node is set up, signed in, your first name and seal
POST /api/account/create/begin|register|finish
Create your identity with a passkey
POST /api/account/signin/begin|finish, POST /api/account/signout
Sign in and out
POST /api/account/stepup/begin|finish
A fresh Face ID for a sensitive act
GET /api/account/sessions, POST /api/account/sessions/{id}/end
Devices and browsers signed in
/api/account/passkey, /api/account/settings, GET /api/account/recovery
Passkeys, sign-in settings, ways back
/api/pair/*
Adding a device with a code
/api/setup/model/*
The first-run model step (ChatGPT sign-in, trying a model)
Accomplice
Route
GET/POST /api/messages
Your conversation; send a message ({text, attachments})
POST /api/messages/{id}/reactions
React to a message
POST /api/cancel
Stop the running turn
GET /api/approvals, POST /api/approvals/{id}
Waiting approvals; decide ({approve})
GET /api/asks, POST /api/asks/{id}/answer
Choice wizards
GET/POST /api/branches, POST /api/branches/{id}/merge
Side conversations
GET /api/turns, GET /api/turns/{id}, GET /api/activity
