One ConnectReference
HTTP API
The local HTTP and WebSocket API the dashboard, the phone layout and the acc command line use. It listens on 127.0.0.1 only.
Warning
This is the dashboard's own API, documented so you can understand and script against your local engine. It is not a stable public API yet: routes and payloads may change between releases.
Address and authentication#
The engine listens on http://127.0.0.1:7317 by default (server.port, --port or ACC_PORT). GET /api/health and /auth need no credential; every other request needs one of:
| Credential | Who uses it | How it is obtained |
|---|---|---|
| Session cookie | Browsers | acc open asks the daemon for a one-time code; /auth?code=… swaps it for an HttpOnly, SameSite=Strict cookie. Sessions are stored hashed and expire on the server after 30 days. |
| Install token | acc and the Mac app | Authorization: Bearer <token>, read from secrets/install-token in the data folder (mode 0600). The Mac app keeps it in Rust and gives the page single-use WebSocket tickets instead. |
| Run token | The acc MCP bridge only | A per-run token, accepted only for its own run |
| Paired phone session | Phones over the tunnel | Pairing; see Phone and alerts |
The Host header must be a local address on the engine's port, which stops DNS rebinding. Cross-origin requests are refused, and state-changing requests without an Origin are refused unless they carry the bearer token. Request bodies are validated, and unknown fields are dropped. Errors return a status code and a plain message.
A quick check from a shell:
TOKEN=$(cat ~/Library/Application\ Support/AgentControlCenter/secrets/install-token)
curl -s -H "Authorization: Bearer $TOKEN" http://127.0.0.1:7317/api/state | head -c 400Live events#
The dashboard connects a WebSocket to /ws. A client says hello with the last event sequence number it has seen and receives either the missed control events or a fresh snapshot, then live events. Run transcripts stream only for runs the client subscribes to; other clients receive updated run summaries. The browser applies the same reducer as the daemon.
Route groups#
Each area of the API lives in its own module under packages/daemon/src/server/.
| Area | Representative routes |
|---|---|
| State | GET /api/state, GET /api/onboarding, GET /api/health |
| Work | POST /api/issues, POST /api/assignments, POST /api/assignments/:id/preflight, POST /api/assignments/:id/dispatch, POST /api/assignments/:id/reassign, GET /api/assignments/:id/diff, POST /api/imports/preview, POST /api/imports/commit |
| Runs | GET /api/runs/:id/events, GET /api/runs/:id/log/page, POST /api/runs/:id/stop, /pause, /resume, /send, /nudge, /relay, /accept-skeleton |
| Agents | POST /api/agents/configure, POST /api/agents/:id/probe, POST /api/agents/:id/model, POST /api/agents/:id/queue, POST /api/agents/:id/account-terms, POST /api/agents/cost-approval |
| Control | POST /api/kill-switch, POST /api/approvals/:id/resolve, POST /api/alerts/:id/resolve, POST /api/rules/:id, POST /api/tracker/poll, GET /api/settings, POST /api/settings/request |
| Reviews, merges and Decisions | POST /api/work-items/:id/review-request, GET /api/work-items/:id/merge-gates, POST /api/work-items/:id/merge-request, POST /api/work-items/:id/acceptance, POST /api/decisions/:id/prepare, POST /api/decisions/:id/answer, GET /api/decisions/:id/history |
| Workflows and canvas | GET /api/workflows, POST /api/workflows, POST /api/workflows/validate, POST /api/workflows/:id/:action, GET /api/canvas, PUT /api/canvas, GET /api/workflow-links |
| Team | GET /api/team, GET /api/team/messages, POST /api/team/messages |
| Context and Dictionary | GET /api/context, POST /api/context/answer/search, GET /api/context/answer/file, GET /api/context/answer/structure, GET /api/context/answer/packet, POST /api/context/answer/refresh, POST /api/context/answer/cancel |
| Local models | GET /api/local-models, POST /api/local-models/summarize |
| Designer and mocks | /api/designer/documents…, /api/designer/contract, /api/designer/validate, /api/designer/jobs…, /api/mocks/:id/… |
| Skills, connectors and marketplace | /api/skills…, /api/connectors…, /api/connections…, /api/marketplace/github/preview, /api/marketplace/mcp |
| Environment | GET /api/environment, POST /api/environment/actions, POST /api/environment/database/plan, GET /api/docker |
| Release and infrastructure | GET /api/release/plans, POST /api/release/plans/:id/steps/:stepId/decision, POST /api/release/refresh, GET /api/infra/health |
| Harnesses and Jev | GET /api/harnesses, GET /api/ollama/status, GET /api/jev, POST /api/decisions/:id/advisory |
| Phone and reports | /api/remote…, /api/reports/brief, /timeline, /morning, /standup |
To add an area, see Extending One Connect.