REST API

The Anthara API is the backend that the web app calls. It publishes interactive OpenAPI documentation and a machine-readable spec. This page shows where to find them and how to authenticate.

Where the documentation is served

The API serves its documentation from three paths.

Path on the API	What it returns
/api/docs	Interactive Swagger UI
/api/docs-json	The OpenAPI spec as JSON
/api/docs-yaml	The OpenAPI spec as YAML

In an on-prem deployment, nginx publishes the API under /api/ and removes that prefix before it forwards the request. As a result, the public URLs contain /api twice.

What you want	Public URL
Swagger UI	https://<your-domain>/api/api/docs
JSON spec	https://<your-domain>/api/api/docs-json
YAML spec	https://<your-domain>/api/api/docs-yaml

Any other route follows the same rule. The API route /repositories is public at https://<your-domain>/api/repositories.

Note

All three paths were checked against a local Anthara stack. Each one returned the Swagger page or the spec. The public path behind the proxy comes from the installer’s proxy template and was not checked on a customer deployment.

Download the spec

curl -fsS "https://<your-domain>/api/api/docs-json" -o anthara-openapi.json

Authentication

The API authenticates a person with a session cookie named access_token. The cookie is set when you sign in to the web app. It is HttpOnly and lasts 24 hours.

There are no personal API keys for the REST API.

To call the API from a script, copy the cookie’s value from your browser after you sign in, and send it with the request:

curl -fsS "https://<your-domain>/api/repositories" \
  --cookie "access_token=<your-session-token>"

Treat the token like a password. It gives the same access as your signed-in session.

Some routes are for admins only. A developer who calls one gets an error. Roles lists the admin-only areas.

Route groups

The table uses the API’s own paths. Add /api in front for the public URL.

Domain	Base path	Purpose	Admin only
Health	/healthcheck	Liveness check. No sign-in needed.	No
Sign-in	/auth	OAuth sign-in with GitHub, Google, or Microsoft, the current user, and sign-out.	No
Members	/users	Invite members, list them, and revoke invitations.	Yes
Repositories	/repositories	Import repositories, run assessments, read results, apply packs, and activate the plugin.	No
Dashboard	/dashboard	Summary figures for the dashboard.	No
Standards	/packs	Packs and their rules.	No
Standards sync	/packs/fabric	Push the pack catalog to Fabric again.	Yes
Memory	/memory	Browse and search memory. Creating or deleting graphs and deleting facts is admin only.	Partly
Memory groups	/memory-groups	List the memory groups offered in the Activate dialog.	No
Connections	/integrations/connections, /integrations/oauth	Connect your account to an app.	No
Connection apps	/integrations/auth-configs	Add, edit, and remove apps.	Yes
Governance	/governance/models, /governance/guardrails, /governance/mcp, /governance/logs, /governance/usage	Everything on the Govern pages.	Yes
Workflows	/workflow-engine/workflows	Create, read, update, and delete workflows.	No
Workflow runs	/workflow-engine	Start, list, inspect, and cancel runs.	No
Coding jobs	/coding-jobs	The jobs behind a Proposed Fix.	No
Admin settings	/admin-settings	The workflow LLM gateway and Anthara Impact switches.	Yes
Impact	/impact	Figures for the Anthara Impact section.	No
Plugin usage	/anthara-usage	Figures for the Anthara Usage section.	No
OIDC provider	/oidc, /.well-known/openid-configuration	The sign-in service that Fabric MCP clients use.	No
OIDC clients	/oidc/clients	Manage OIDC clients.	Yes
Inbound webhooks	/github/webhooks, /azure-devops/webhooks, /teams/webhook	Called by GitHub, Azure DevOps, and Microsoft Teams. Each verifies its caller.	No
Integration status	/github/app, /azure-devops	Whether the GitHub App and Azure DevOps settings are present.	Yes

Why there is no endpoint list here

These docs don’t include a generated list of every endpoint. The API repository has no script that exports the OpenAPI spec, so a copied list would go out of date with each release. The Swagger UI on your own deployment always matches the version you run.

Two limits of the Swagger UI are worth knowing:

• It documents the session cookie only. Routes that services call with other credentials are not described with their auth scheme.
• A few route groups, such as the OIDC provider, have no tag, so they appear ungrouped.