Core configuration API

Auth, config, and identity endpoints.

Auth

GET /api/auth/whoami

Returns the identity and claims of the current request’s token. This route is open so the dashboard can determine whether to show the login screen; if an Authorization header is present, the token is validated opportunistically. In local mode, authenticated is always false and claims is null. effectiveAccess is true when the current request can use the dashboard without another login, including trusted localhost requests in hybrid mode.

Response

{
  "authenticated": true,
  "claims": {
    "sub": "token:operator",
    "role": "operator",
    "scope": { "project": "my-project" },
    "iat": 1740000000,
    "exp": 1740086400
  },
  "trustedLocal": false,
  "effectiveAccess": true,
  "mode": "team",
  "providers": [
    { "id": "password", "type": "password", "enabled": true, "username": "admin" },
    { "id": "sso", "type": "oidc", "enabled": false, "startPath": "/api/auth/sso/start" },
    { "id": "saml", "type": "saml", "enabled": false, "startPath": "/api/auth/saml/start" }
  ]
}

GET /api/auth/methods

Open route returning configured dashboard login providers. Password login is enabled when SIGNET_ADMIN_PASSWORD, SIGNET_ADMIN_PASSWORD_HASH, or auth.login.password.passwordHash is set. SSO and SAML entries are exposed as reserved provider paths for future implementation.

POST /api/auth/login

Open route that exchanges the configured admin username and password for an admin session bearer token. Rate-limited to 5 attempts/minute.

Request body

{ "username": "admin", "password": "..." }

Response

{
  "token": "<token>",
  "expiresAt": "2026-02-22T10:00:00.000Z",
  "role": "admin",
  "username": "admin"
}

Returns 401 for invalid credentials, 429 when rate-limited, and 503 when password login has not been configured.

GET /api/auth/sso/start

GET /api/auth/sso/callback

GET /api/auth/saml/start

POST /api/auth/saml/acs

Open reserved provider paths. They currently return 501 until SSO/SAML providers are implemented.

POST /api/auth/token

Create a signed JWT. Requires admin permission. Rate-limited to 10 requests/min.

Request body

{
  "role": "agent",
  "scope": { "project": "my-project", "agent": "claude", "user": "nicholai" },
  "ttlSeconds": 86400
}

role is required and must be one of admin, operator, agent, readonly. scope is optional — an empty object creates an unscoped token. ttlSeconds defaults to the value in authConfig.defaultTokenTtlSeconds.

Response

{
  "token": "<jwt>",
  "expiresAt": "2026-02-22T10:00:00.000Z"
}

Returns 400 if role is invalid or auth secret is unavailable (local mode). Returns 400 if the request body is missing or malformed.

GET /api/auth/api-keys

List named daemon API keys. Requires admin permission. The response never includes raw sig_sk_... key values; raw keys are only returned once at creation time.

Response

{
  "apiKeys": [
    {
      "id": "key_abc123",
      "prefix": "1b363ad385e1",
      "name": "work laptop pi",
      "role": "agent",
      "scope": { "agent": "pi-work-laptop" },
      "permissions": ["recall", "remember", "documents"],
      "connector": "pi",
      "harness": "pi",
      "agentId": "pi-work-laptop",
      "allowedProjects": [],
      "createdAt": "2026-06-11T04:02:17.922Z",
      "lastUsedAt": null,
      "revokedAt": null,
      "expiresAt": null
    }
  ]
}

POST /api/auth/api-keys

Create a named API key for remote connectors or other daemon clients. Requires admin permission. The raw key is returned once in this response and is stored hashed at rest.

Request body

{
  "name": "work laptop pi",
  "connector": "pi",
  "role": "agent",
  "agentId": "pi-work-laptop",
  "scope": { "agent": "pi-work-laptop" },
  "allowedProjects": [],
  "expiresAt": null
}

name is required. role defaults to agent and must be one of admin, operator, agent, or readonly when provided. connector, harness, agentId, allowedProjects, scope, permissions, and expiresAt are optional. agentId is connector metadata; API callers should also set scope: { "agent": "..." } when scope-guarded API surfaces should be limited to that agent. For connector keys, scope.agent should usually match agentId. The Signet CLI does this automatically when you run signet api-key create --agent-id <id>. Connector keys default to the connector permission set: recall, remember, and documents.

Response

{
  "apiKey": {
    "id": "key_abc123",
    "prefix": "1b363ad385e1",
    "name": "work laptop pi",
    "role": "agent",
    "scope": { "agent": "pi-work-laptop" },
    "permissions": ["recall", "remember", "documents"],
    "connector": "pi",
    "harness": "pi",
    "agentId": "pi-work-laptop",
    "allowedProjects": [],
    "createdAt": "2026-06-11T04:02:17.922Z",
    "lastUsedAt": null,
    "revokedAt": null,
    "expiresAt": null,
    "key": "sig_sk_..."
  }
}

Returns 400 if the request body is missing or malformed, name is empty, role is invalid, or expiresAt is not a valid ISO timestamp.

DELETE /api/auth/api-keys/:id

Revoke an API key by id or prefix. Requires admin permission. Revocation is idempotent for an existing key: already-revoked keys are returned with their original revokedAt timestamp.

Response

{
  "apiKey": {
    "id": "key_abc123",
    "prefix": "1b363ad385e1",
    "name": "work laptop pi",
    "role": "agent",
    "scope": { "agent": "pi-work-laptop" },
    "permissions": ["recall", "remember", "documents"],
    "connector": "pi",
    "harness": "pi",
    "agentId": "pi-work-laptop",
    "allowedProjects": [],
    "createdAt": "2026-06-11T04:02:17.922Z",
    "lastUsedAt": null,
    "revokedAt": "2026-06-11T05:00:00.000Z",
    "expiresAt": null
  }
}

Returns 404 if the id or prefix does not match an API key.

Config

GET /api/config

Returns all .md and .yaml files from the agents directory ($SIGNET_WORKSPACE/), sorted by priority: agent.yaml, AGENTS.md, SOUL.md, IDENTITY.md, USER.md, then alphabetically.

Response

{
  "files": [
    { "name": "agent.yaml", "content": "...", "size": 1024 },
    { "name": "AGENTS.md", "content": "...", "size": 4096 }
  ]
}

POST /api/config

Write a config file. File name must end in .md or .yaml and must not contain path separators.

Request body

{
  "file": "SOUL.md",
  "content": "# Soul\n..."
}

Response

{
  "success": true
}

Returns 400 for invalid file names, path traversal attempts, or wrong file or payload types. Returns 403 when saving a guarded config file (agent.yaml, AGENT.yaml, config.yaml) without admin permission in team or hybrid auth mode.

Provider selection is configured through the canonical inference routing block. Retired memory.pipelineV2 provider/model/endpoint fields are rejected by the daemon loader; use the migration guidance on the upgrading page.

Identity

GET /api/identity

Parses IDENTITY.md and returns the structured fields.

Response

{
  "name": "Aria",
  "creature": "fox",
  "vibe": "calm and curious"
}

Returns defaults ({ "name": "Unknown", "creature": "", "vibe": "" }) if the file is missing or unreadable.