# REST API Reference

This is the maintained human inventory for the supported Omnius daemon API. The
machine contract is generated by `packages/cli/src/api/openapi.ts` and served at
`/openapi.json`; every operation in that contract must appear here, and the
generated REST block in the root README must match this file byte-for-byte after
heading normalization. Browser HTML routes and implementation-only compatibility
bridges are documented separately and are not part of the stable REST contract.

Run the drift check before publishing docs:

```bash
pnpm docs:check
```

## Docs And Compatibility Aliases

| Method | Path | Purpose |
| --- | --- | --- |
| `GET` | `/docs` | Swagger UI |
| `GET` | `/api/docs` | Swagger UI alias |
| `GET` | `/openapi.json` | OpenAPI JSON |
| `GET` | `/openapi.yaml` | OpenAPI YAML |
| `GET` | `/v3/api-docs` | OpenAPI alias |
| `GET` | `/swagger.json` | Swagger-era alias |
| `GET` | `/api-docs` | OpenAPI alias |
| `GET` | `/swagger-ui` | Swagger UI alias |
| `GET` | `/redoc` | ReDoc renderer |
| `GET` | `/` | HATEOAS API root when the client does not request HTML |
| `GET` | `/help` | Compact daemon integration help |
| `GET` | `/v1/routes` | Flat grep-friendly daemon route summary |
| `GET` | `/routes` | Route-summary compatibility alias |
| `GET` | `/asyncapi.json` | AsyncAPI 2.6 voicechat WebSocket contract |
| `GET` | `/asyncapi` | AsyncAPI compatibility alias |

## Health And Observability

| Method | Path | Purpose |
| --- | --- | --- |
| `GET` | `/health` | Liveness probe |
| `GET` | `/health/ready` | Backend readiness |
| `GET` | `/health/startup` | Startup probe |
| `GET` | `/version` | Package version and platform |
| `GET` | `/metrics` | Prometheus metrics |
| `GET` | `/v1/events` | Server-sent event stream |
| `GET` | `/v1/usage` | Token usage and rate limits |
| `GET` | `/v1/audit` | Audit log query |
| `GET` | `/v1/cost` | Cost tracker |
| `GET` | `/v1/system` | CPU, RAM, GPU, and system snapshot |

## Discovery

| Method | Path | Purpose |
| --- | --- | --- |
| `GET` | `/v1/discovery/bootstrap` | Compact agent bootstrap and start-here map |
| `GET` | `/v1/discovery` | Search layers, workflows, runtimes, modules, stores, and capabilities |
| `GET` | `/v1/discovery/{id}` | Expand one stable capability entry |

## Inference And Chat

| Method | Path | Purpose |
| --- | --- | --- |
| `GET` | `/v1/models` | Aggregated model list |
| `POST` | `/v1/chat/completions` | OpenAI-compatible chat completion |
| `POST` | `/v1/chat` | Stateful Omnius chat |
| `POST` | `/api/chat` | Ollama-compatible chat alias |
| `POST` | `/v1/generate` | Ollama-compatible one-shot generation |
| `POST` | `/api/generate` | Ollama-compatible generate alias |
| `POST` | `/v1/embeddings` | OpenAI-compatible embeddings |
| `POST` | `/api/embed` | Ollama-compatible embeddings alias |
| `GET` | `/api/tags` | Ollama-compatible model tags |
| `POST` | `/realtime` | Text-only voice-adapter reply from a transcript |
| `POST` | `/v1/realtime` | Auth-scoped realtime adapter alias |
| `GET` | `/v1/chat/sessions` | Workspace-scoped persisted browser chats and importable TUI sessions |
| `GET` | `/v1/chat/sessions/{id}` | Hydrate full session history, transcript, and in-flight state |
| `DELETE` | `/v1/chat/sessions/{id}` | Permanently delete a canonical chat or TUI history session |
| `POST` | `/v1/chat/sessions/{id}/summarize` | Generate + cache an inference-based session title/summary |
| `POST` | `/v1/chat/suggest-followup` | Suggest one short next-message follow-up (ghost-text input) |
| `GET` | `/v1/chat/sessions/{id}/status` | Reactive recall: live run status + unseen deltas (`?since=<seq>`) |
| `POST` | `/v1/chat/check-in` | Steering check-in for active chat |
| `POST` | `/v1/chat/attachments` | Upload an attachment for a stateful chat |

### Session History Contract

`GET /v1/chat/sessions` is a history index, not merely a list of processes that
are currently active. It returns canonical persisted browser chats for the
selected workspace and, by default, quality-filtered TUI visual sessions that
can be imported on demand. Pass `?root=/absolute/workspace` to scope the list and
`?include_tui=0` to omit TUI history. Exit-only inputs such as `/quit` and
`/exit`, manual-save noise, empty transcripts, and duplicate normalized TUI
sessions are rejected by the session-quality projection rather than presented as
chats.

Selecting a row should call `GET /v1/chat/sessions/{id}`. That response hydrates
the complete public message history (system prompts are intentionally omitted),
the original TUI transcript when applicable, token counts, timestamps, source
and project identity, and any in-flight run with a bounded partial-output tail.
Use the `status` endpoint with `?since=<seq>` for cheap reactive polling while a
run is active. `DELETE /v1/chat/sessions/{id}` is an admin operation and removes
the canonical record; deleting only a browser-side row does not remove daemon
history.

`POST /realtime` and `/v1/realtime` are text-only conversation adapters. They
accept transcript text through `message`, `text`, `recent_turn`, `asr_text`, or
`callerText`, optionally accept adapter-local `soul_md`, and can return plain
text with `Accept: text/plain` or `format: "text"`. ASR and TTS remain separate
operations.

## Agentic Runs

| Method | Path | Purpose |
| --- | --- | --- |
| `POST` | `/v1/run` | Submit agentic task |
| `GET` | `/v1/runs` | List runs |
| `GET` | `/v1/runs/{id}` | Get run details |
| `GET` | `/v1/runs/{id}/output` | Read captured run output and status |
| `DELETE` | `/v1/runs/{id}` | Abort run |
| `POST` | `/v1/todos` | Create or update todos for current session |
| `GET` | `/v1/todos` | List sessions with todos |
| `GET` | `/v1/todos/{session_id}` | Get session todos |
| `DELETE` | `/v1/todos/{session_id}` | Delete session todos |
| `POST` | `/v1/evaluate` | Evaluate a run |
| `POST` | `/v1/index` | Trigger repository indexing |

## Configuration, Keys, Profiles, Projects

| Method | Path | Purpose |
| --- | --- | --- |
| `GET` | `/v1/config` | Read daemon config |
| `PATCH` | `/v1/config` | Update daemon config |
| `GET` | `/v1/config/model` | Current model |
| `PUT` | `/v1/config/model` | Switch model |
| `POST` | `/v1/config/model/check` | Probe model readiness with non-empty text |
| `GET` | `/v1/config/endpoint` | Current endpoint |
| `PUT` | `/v1/config/endpoint` | Switch endpoint |
| `POST` | `/v1/config/endpoint/test` | Probe endpoint |
| `GET` | `/v1/config/endpoint/history` | Endpoint history |
| `DELETE` | `/v1/config/endpoint/history` | Remove endpoint history item |
| `POST` | `/v1/share/generate` | Generate remote-access share URL |
| `GET` | `/v1/keys` | List runtime API keys |
| `POST` | `/v1/keys` | Mint runtime API key |
| `DELETE` | `/v1/keys/{prefix}` | Revoke runtime API keys by prefix |
| `GET` | `/v1/profiles` | List tool profiles |
| `POST` | `/v1/profiles` | Create tool profile |
| `GET` | `/v1/profiles/{name}` | Get profile |
| `DELETE` | `/v1/profiles/{name}` | Delete profile |
| `GET` | `/v1/projects` | List known projects |
| `DELETE` | `/v1/projects` | Unregister a project |
| `GET` | `/v1/projects/current` | Current project |
| `POST` | `/v1/projects/switch` | Switch project |
| `POST` | `/v1/projects/register` | Register project |
| `POST` | `/v1/projects/rename` | Rename project |
| `GET` | `/v1/projects/preferences` | Read project preferences |
| `PUT` | `/v1/projects/preferences` | Patch project preferences |
| `DELETE` | `/v1/projects/preferences` | Reset project preferences |
| `GET` | `/v1/projects/scan` | Scan configured roots for discoverable workspaces |
| `GET` | `/v1/admin/access` | Read the daemon network access mode |
| `POST` | `/v1/admin/access` | Change and persist access mode from loopback only |

## Skills, Commands, Tools, MCP

| Method | Path | Purpose |
| --- | --- | --- |
| `GET` | `/v1/skills` | List skills |
| `GET` | `/v1/skills/{name}` | Load skill content |
| `GET` | `/v1/commands` | List slash commands |
| `POST` | `/v1/commands/{cmd}` | Execute slash command |
| `GET` | `/v1/tools` | List tools (built-in + external) |
| `POST` | `/v1/tools/register` | Register an application-specific external tool |
| `GET` | `/v1/tools/{name}` | Tool metadata |
| `DELETE` | `/v1/tools/{name}` | Unregister an external tool |
| `POST` | `/v1/tools/{name}/call` | Call tool |
| `POST` | `/v1/tools/{name}/eval` | Evaluate an external tool against test cases |
| `GET` | `/v1/mcps` | List MCP servers |
| `GET` | `/v1/mcps/{name}` | MCP server details |
| `POST` | `/v1/mcps/{name}/call` | Call MCP tool |
| `GET` | `/v1/hooks` | Hook registry |
| `GET` | `/v1/agents` | Agent type registry |
| `GET` | `/v1/codegraph/snapshot` | Code graph snapshot |
| `GET` | `/v1/codegraph/events` | Code graph SSE |

### Registering Application-Specific Tools

Applications can register their own tools so Omnius agents can discover and
invoke them alongside built-ins. `transport.type` selects the bridge:

- `http` makes Omnius POST `{name, args, session_id}` to the application's
  `callback_url` and relay the result.
- `mcp` proxies to a named tool on an MCP server and can auto-connect from the
  supplied connection descriptor.

Registrations persist per workspace at `.omnius/external-tools.json`, appear in
`GET /v1/tools`, and use the same scope and off-device security gates as built-in
tools. Registration needs `run` scope; a non-loopback caller needs `admin`.

```bash
curl -s -X POST localhost:11435/v1/tools/register -H 'content-type: application/json' -d '{
  "name": "lookup_order",
  "description": "Look up an order by id",
  "parameters": {"type":"object","properties":{"id":{"type":"string"}},"required":["id"]},
  "security": {"requires_scope":"run","risk":"low"},
  "transport": {"type":"http","callback_url":"https://app.internal/tools/lookup_order","auth_header":"Bearer …"}
}'
curl -s localhost:11435/v1/tools/lookup_order
curl -s -X POST localhost:11435/v1/tools/lookup_order/call -H 'content-type: application/json' -d '{"args":{"id":"A-1001"}}'
curl -s -X POST localhost:11435/v1/tools/lookup_order/eval -H 'content-type: application/json' -d '{"cases":[{"name":"known","args":{"id":"A-1001"},"expect":{"success":true}}]}'
curl -s -X DELETE localhost:11435/v1/tools/lookup_order
```

The MCP equivalent uses a transport such as
`{"type":"mcp","server":"acme","tool":"search","connect":{"url":"https://app.internal/mcp","transport":"streamable-http"}}`.

## AIWG

| Method | Path | Purpose |
| --- | --- | --- |
| `GET` | `/v1/aiwg` | AIWG root and control map |
| `GET` | `/v1/aiwg/frameworks` | List frameworks |
| `GET` | `/v1/aiwg/frameworks/{name}` | Framework details |
| `GET` | `/v1/aiwg/frameworks/{name}/content` | Tier-aware content |
| `GET` | `/v1/aiwg/skills` | List AIWG skills |
| `GET` | `/v1/aiwg/skills/{name}` | Load AIWG skill |
| `GET` | `/v1/aiwg/agents` | List AIWG agents |
| `GET` | `/v1/aiwg/agents/{name}` | Load AIWG agent |
| `GET` | `/v1/aiwg/addons` | List AIWG addons |
| `POST` | `/v1/aiwg/use` | Tier-sized activation bundle |
| `POST` | `/v1/aiwg/expand` | Expand matching AIWG item |

## Memory, Sessions, Context

| Method | Path | Purpose |
| --- | --- | --- |
| `GET` | `/v1/memory` | Memory backend summary |
| `POST` | `/v1/memory/search` | Search memory |
| `POST` | `/v1/memory/write` | Write memory |
| `GET` | `/v1/memory/episodes` | List episodes |
| `GET` | `/v1/memory/failures` | List failure records |
| `POST` | `/v1/memory/ingest` | Ingest content or files into memory |
| `GET` | `/v1/memory/entities` | List extracted memory entities |
| `POST` | `/v1/memory/jobs/run` | Run a named memory-maintenance job |
| `POST` | `/v1/memory/feedback` | Record relevance or quality feedback for a memory item |
| `POST` | `/v1/memory/speaker-identities/enroll` | Admin-only, explicit-consent speaker exemplar enrollment in one exact vector space |
| `POST` | `/v1/memory/speaker-identities/match` | Admin-only provisional speaker candidate matching without durable assignment |
| `GET` | `/v1/sessions` | List task sessions |
| `GET` | `/v1/sessions/{id}` | Get session history |
| `GET` | `/v1/context` | Current context snapshot |
| `GET` | `/v1/context/window-dumps` | List persisted outbound model context-window dumps |
| `GET` | `/v1/context/window-dumps/{id}` | Fetch a full outbound model context-window dump |
| `POST` | `/v1/context/save` | Save context entry |
| `GET` | `/v1/context/restore` | Build restore prompt |
| `POST` | `/v1/context/compact` | Request compaction |

Context-window dumps are written before backend inference for main agents,
sub-agents, internal runners, and adversary audits. Query
`GET /v1/context/window-dumps?agent_type=main` for summaries with signal/noise
metrics, or fetch a full payload by id. Dumps include focus-supervisor state when
a next-action contract is active. Set `OMNIUS_CONTEXT_WINDOW_DUMP_DIR` to move
the store, `OMNIUS_DISABLE_CONTEXT_WINDOW_DUMPS=1` to disable it, and
`OMNIUS_FOCUS_SUPERVISOR=off|auto|strict` to tune focus enforcement.

## Files, Nexus, Ollama Pool

| Method | Path | Purpose |
| --- | --- | --- |
| `GET` | `/v1/files` | List workspace directory |
| `POST` | `/v1/files/read` | Read workspace file |
| `GET` | `/v1/files/raw` | Stream raw workspace bytes with content type and range support |
| `HEAD` | `/v1/files/raw` | Inspect raw-file response metadata |
| `GET` | `/v1/nexus/status` | Nexus peer state |
| `GET` | `/v1/sponsors` | Sponsor directory cache |
| `GET` | `/v1/ollama/pool/processes` | Ollama process inventory |
| `POST` | `/v1/ollama/pool/cleanup` | Cleanup stale Ollama pool processes |

## Voice, Audio, Vision

| Method | Path | Purpose |
| --- | --- | --- |
| `GET` | `/v1/voice/state` | Voice runtime status |
| `POST` | `/v1/voice/start` | Select an optional model, enable voice, and wait for readiness |
| `POST` | `/v1/voice/stop` | Pause daemon voice input while leaving TTS warm |
| `GET` | `/v1/voice/models` | TTS models |
| `POST` | `/v1/voice/models/switch` | Switch and enable an exact TTS model by default |
| `GET` | `/v1/voice/supertonic-settings` | Voice tuning settings |
| `POST` | `/v1/voice/supertonic-settings` | Update voice tuning settings |
| `GET` | `/v1/asr/engines` | Canonical ASR engines/models, capabilities, readiness, and selection |
| `GET` | `/v1/asr/status` · `/v1/asr/selection` | Selected engine/model and runtime status |
| `PATCH` | `/v1/asr/selection` | Persist and activate an exact engine/model |
| `POST` | `/v1/asr/activate` | Activate and persist an exact engine/model |
| `POST` | `/v1/asr/engines/{engineId}/setup` | Install a managed runtime and pinned weights |
| `POST` | `/v1/asr/transcriptions` · `/v1/asr/test` | Transcribe/test using the real selected backend |
| `GET` | `/v1/voice/asr-models` | Compatibility registry alias |
| `POST` | `/v1/voice/asr-models/switch` | Compatibility activation alias |
| `POST` | `/v1/voice/tts` | Synthesize speech |
| `POST` | `/v1/audio/speech` | OpenAI-compatible TTS alias |
| `GET` | `/v1/audio/classify/health` | Jetson CUDA/TensorRT YAMNet readiness |
| `POST` | `/v1/audio/classify/setup` | Provision and warm the pinned JetPack TensorRT YAMNet runtime |
| `POST` | `/v1/audio/classify` | Direct-tool compatible CUDA audio classification |
| `GET` | `/v1/audio/embed/health` | Role-typed embedding readiness (`?kind=acoustic|speaker|semantic`) |
| `POST` | `/v1/audio/embed/setup` | Provision/warm one role-typed embedding runtime (admin; `?kind=...`) |
| `POST` | `/v1/audio/embed` | Managed role-typed audio embedding (`?kind=...`) |
| `GET` | `/v1/audio/diarization/live/readiness` | Non-mutating managed Sortformer worker readiness |
| `POST` | `/v1/audio/diarization/live/setup` | Verify and warm a local Sortformer runtime (admin) |
| `POST` | `/v1/audio/diarization/live` | Managed live/session-local speaker-turn diarization |
| `POST` | `/v1/audio/diarization/live/cancel` | Terminate live worker work and clear its queue |
| `GET` | `/v1/audio/diarization/reconcile/readiness` | Non-mutating managed Community-1 worker readiness |
| `POST` | `/v1/audio/diarization/reconcile/setup` | Verify and warm a local Community-1 runtime (admin) |
| `POST` | `/v1/audio/diarization/reconcile` | Managed offline/dream reconciliation proposals |
| `POST` | `/v1/audio/diarization/reconcile/cancel` | Terminate reconciliation work and clear its queue |
| `POST` | `/v1/voice/transcribe` | Transcribe audio |
| `POST` | `/v1/voice/asr` | Legacy transcription alias |
| `POST` | `/v1/audio/transcriptions` | OpenAI-compatible transcription alias |
| `POST` | `/v1/voice/transcribe/stream` | Isolated final transcription over SSE (no shared mic state or fake partials) |
| `POST` | `/v1/voice/clone-refs` | Upload voice clone reference |
| `GET` | `/v1/voice/clone-refs` | List clone references |
| `POST` | `/v1/voice/clone-refs/upload` | Upload clone reference |
| `POST` | `/v1/voice/clone-refs/from-url` | Fetch clone reference |
| `POST` | `/v1/voice/clone-refs/{filename}/activate` | Activate clone reference |
| `POST` | `/v1/voice/clone-refs/{filename}/rename` | Rename clone reference |
| `DELETE` | `/v1/voice/clone-refs/{filename}` | Delete clone reference |
| `POST` | `/v1/voice/speak` | Broadcast speech to voicechat clients |
| `GET` | `/v1/voicechat/ws` | WebSocket upgrade for full-duplex voicechat |
| `POST` | `/v1/vision/describe` | Vision describe placeholder |
| `GET` | `/v1/vision/embed/readiness` | Non-mutating isolated OpenCLIP readiness |
| `POST` | `/v1/vision/embed/setup` | Explicit isolated OpenCLIP setup (admin scope) |
| `POST` | `/v1/vision/embed` | Create a vision embedding from media |
| `GET` | `/v1/ocr/readiness` | Non-mutating advanced-OCR dependency and backend readiness |
| `POST` | `/v1/ocr/setup` | Create and verify the isolated OCR venv (admin scope) |
| `POST` | `/v1/ocr/advanced` | Agent-equivalent managed advanced OCR (alias of `/v1/tools/ocr_image_advanced/call`) |

`POST /v1/voice/tts` and `/v1/audio/speech` automatically warm the daemon.
An explicit model must render exactly or the request fails; Omnius does not
silently synthesize with another voice. Responses include `X-Voice-Model`,
`X-Voice-Backend`, and `X-Sample-Rate`. Available models include GLaDOS,
Overwatch, `luxtts:announcer-testchamber03`, and the selected Voicebox suite.
Set `OMNIUS_VOICEBOX_MODELS=all` for every carried-in Voicebox model, leave it
at `stable` for the default set, or provide a comma-separated subset.

ASR selection is independent from TTS selection. The registry currently exposes
OpenAI Whisper, managed `transcribe-cli`, NVIDIA Nemotron (reported unavailable
until its legacy bootstrap is migrated), and Microsoft VibeVoice ASR. VibeVoice
uses the exact pinned `microsoft/VibeVoice-ASR` checkpoint, reports setup and
activation separately, supports completed files up to 60 minutes with speakers,
timestamps, and `?context=` hotwords, and is deliberately not advertised as an
incremental PCM backend. Its managed setup inherits the host CUDA-enabled Torch
build (needed on Jetson/ARM64), never installs generic PyPI Torch, and activation
requires one explicit capable GPU. Discrete Linux uses `nvidia-smi` process/GPU
evidence; Jetson/L4T uses NVIDIA's documented `tegrastats` plus CUDA Torch device
properties because `nvidia-smi` is unavailable there. Model weights live under
the unified Omnius ASR cache and are not shipped in the npm package.

## Generative Media

All generation is backed by the unified `~/.omnius` model store and shared venvs (single source of truth — no per-project duplication). Generated files are consolidated into the global gallery at `~/.omnius/media/{images,videos,audio,music}`.

| Method | Path | Purpose |
| --- | --- | --- |
| `GET` | `/v1/media/models` | List available image/video/audio/music models |
| `GET` | `/v1/media/store` | Unified store disk usage + reclaimable legacy caches |
| `POST` | `/v1/media/migrate` | Dedup + migrate legacy per-group caches into the unified store |
| `POST` | `/v1/media/relocate` | Relocate the whole media store (weights/venvs/gallery) to a chosen folder |
| `GET` | `/v1/media/relocate/status` | Status + progress of the media-store relocation job |
| `POST` | `/v1/media/av/analyze` | Analyze a media file into a grounded entity/event answer (AV comprehension) |
| `POST` | `/v1/media/image` | Generate an image |
| `POST` | `/v1/media/video` | Generate a video |
| `POST` | `/v1/media/audio` | Generate a sound effect |
| `POST` | `/v1/media/music` | Generate music |
| `GET` | `/v1/media/gallery` | List previously generated media (global, newest first) |
| `GET` | `/v1/media/file` | Stream one generated media file |

## Engines And Scheduled Jobs

| Method | Path | Purpose |
| --- | --- | --- |
| `GET` | `/v1/engines` | Long-running engine status |
| `GET` | `/v1/scheduled` | List scheduled jobs |
| `DELETE` | `/v1/scheduled/all` | Delete all tasks, timers, cron entries, and persisted sources |
| `GET` | `/v1/scheduled/status` | Scheduler status |
| `POST` | `/v1/scheduled/{id}` | Enable or disable one scheduled task or user timer |
| `DELETE` | `/v1/scheduled/{id}` | Delete one scheduled task or user timer |
| `POST` | `/v1/scheduled/kill` | Kill scheduled job |
| `POST` | `/v1/scheduled/fixup` | Reconcile scheduled state |
| `GET` | `/v1/scheduled/reconcile` | Preview scheduled reconciliation |
| `POST` | `/v1/scheduled/reconcile` | Preview or apply scheduled reconciliation |
| `GET` | `/v1/services/systemd` | Systemd service status |
| `POST` | `/v1/services/systemd/{unit}` | Act on one user-level systemd unit |
| `GET` | `/v1/update` | Self-update status |
| `POST` | `/v1/update` | Start an exact-version verified global update transaction |

### Verified Global Update Transaction

`POST /v1/update` is not a CLI-local package edit. It starts one durable
transaction that installs the requested exact npm version globally, verifies
the installed package and resolved `omnius` executable, restarts and verifies
the daemon, verifies package/hash/runtime agreement, and relaunches the tray if
it was running. The response is `202` with operation state; poll
`GET /v1/update` for live phase, subprocess output, verification evidence, and
the final success or failure. Concurrent transactions and requests with no
available target return `409`.

The web dashboard and native tray both use this same endpoint. Update discovery
is shared and semver-aware, so an older cached registry result cannot downgrade
or falsely present an update. A completed transaction means the global package,
executable, daemon, and tray runtime were all reconciled—not merely that `npm`
exited successfully.

## AIMS Governance

| Method | Path | Purpose |
| --- | --- | --- |
| `GET` | `/v1/aims` | AIMS root and endpoint index |
| `GET` | `/v1/aims/policies` | Policy register |
| `PUT` | `/v1/aims/policies` | Replace policy register |
| `GET` | `/v1/aims/roles` | Roles and responsibilities |
| `GET` | `/v1/aims/resources` | Resource inventory |
| `GET` | `/v1/aims/impact-assessments` | Impact assessments |
| `POST` | `/v1/aims/impact-assessments` | File impact assessment |
| `GET` | `/v1/aims/lifecycle` | Lifecycle state |
| `GET` | `/v1/aims/data-quality` | Data quality controls |
| `GET` | `/v1/aims/transparency` | Model cards and transparency |
| `GET` | `/v1/aims/usage` | AIMS usage view |
| `GET` | `/v1/aims/suppliers` | Supplier inventory |
| `GET` | `/v1/aims/incidents` | Incident records |
| `POST` | `/v1/aims/incidents` | File incident |
| `GET` | `/v1/aims/oversight` | Human oversight gates |
| `GET` | `/v1/aims/decisions` | Consequential decision log |
| `GET` | `/v1/aims/config-history` | Config change history |

## Browser And Compatibility Surfaces

The dashboard HTML routes (`/`, `/chat`, `/agent`, `/voice`, `/generate`,
`/projects`, `/dashboard`, `/jobs`, `/activity`, `/discover`, `/settings`, and
`/config`) are documented in the [dashboard guide](../guides/dashboard.md). They
are pages, not JSON API operations; `/` returns the HATEOAS JSON root when the
client does not request HTML.

Swagger/ReDoc trailing-slash variants, `/api/docs/*` static assets, and
`/favicon.ico` exist for browsers. They are delivery details rather than stable
integration endpoints. The daemon also retains browser/legacy bridges at
`/v1/model`, `/v1/endpoint`, `/v1/theme`, `/v1/tor/*`, `/v1/remote-proxy`, and
`/v1/command`. New clients should prefer `/v1/config/model`,
`/v1/config/endpoint`, `/v1/config`, and `/v1/commands/{cmd}`. Compatibility
handlers may accept additional HTTP verbs for old dashboard bundles; only the
methods in the supported inventory above are contractual.